# \[Resolved\]\[kinaba7.0\]Terms aggregration doesn;t aggregrate by individual values in array
**URL:** https://discuss.elastic.co/t/resolved-kinaba7-0-terms-aggregration-doesn-t-aggregrate-by-individual-values-in-array/190366
**Category:** Kibana
**Created:** [July 14, 2019, 1:35am UTC](https://discuss.elastic.co/t/resolved-kinaba7-0-terms-aggregration-doesn-t-aggregrate-by-individual-values-in-array/190366 "2019-07-14T01:35:29Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@cheriemilk](https://discuss.elastic.co/u/cheriemilk)
#### Post date: [July 14, 2019, 1:35am UTC](https://discuss.elastic.co/t/resolved-kinaba7-0-terms-aggregration-doesn-t-aggregrate-by-individual-values-in-array/190366/1 "2019-07-14T01:35:29Z")
Hi team,
I am running into an issue in ELK production environment and can’t figure out why googled. The google result is saying that it might because the ktf1.raw field not enabled. But I still failed after apply the raw field. Can you help have a look and advice?
Issue Description:
1. I have below data in elk, the value for ktf1, kf1, kf2, ktf3 are arrays. In Kibana, I want the it aggregate by the values in the array. But I didn’t get the expected result. It treat the array as a string, and aggregrate based on the string. Please refer to the screenshot in point3 .
> ```
> at,ktf1,kf1,kf2,kf3
> SAVE,"[performance,compensation]","[true,true,false,false]","[false,false,false,false]","[false,false,false,false]"
> SAVE,"[performance,compensation,Others]","[true,true,true,false]","[false,false,false,false]","[true,true,false,false]"
> SAVE,"[performance,compensation,Others]","[true,true,true,false]","[false,false,false,false]","[true,true,false,false]"
> SAVE,"[performance,compensation,Others]","[true,true,true,false]","[false,false,false,false]","[true,true,false,false]"
> SAVE,"[performance,compensation,liveProfile,talentFlag,Others]","[true,false,false,false]","[false,false,false,false]","[true,false,false,false]"
>
> ```
1. **The** **index template** definition for ktf1, kf1, kf2, ktf3 are below.
\> {
> ```
> "template": "kvaudit",
> "index_patterns": ["kvaudit"],
> "settings": {
> "index": {
> "number_of_shards": "1",
> "codec": "best_compression",
> "number_of_replicas": "0"
> }
> },
> "mappings": {
> "doc": {
> "properties": {
> "@version": {
> "type": "keyword" }
> }
> }
> },
> "beat": {
> "properties": {
> "version": {
> "type": "keyword"
> }
> }
> },
>
> "fields": {
> "properties": { "at": {"type": "keyword"},
> "ktf1": {"type": "text","fields": {"raw": {"type": "keyword","ignore_above": 256}}},
> "ktf2": {"type": "keyword"},
> "ktf3": {"type": "keyword"},
> "ktf4": {"type": "keyword"},
> "ktf5": {"type": "keyword"},
> "kf1": {"type": "keyword"},
> "kf2": {"type"："keyword"},
> "kf3": {"type"："keyword"}}}
> }
>
> ```
1. Screenshot of Terms aggregration
---
### Author:  [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)
#### Post date: [July 18, 2019, 11:46am UTC](https://discuss.elastic.co/t/resolved-kinaba7-0-terms-aggregration-doesn-t-aggregrate-by-individual-values-in-array/190366/2 "2019-07-18T11:46:41Z")
Kibana doesn't fully support nested objects and arrays so this might be why it's not working for you. But, a quick question first: after you made the field analyzed, did you reindex the data so that it got analyzed by Elasticsearch?
---
### Author:  [@cheriemilk](https://discuss.elastic.co/u/cheriemilk)
#### Post date: [July 18, 2019, 11:48am UTC](https://discuss.elastic.co/t/resolved-kinaba7-0-terms-aggregration-doesn-t-aggregrate-by-individual-values-in-array/190366/3 "2019-07-18T11:48:30Z")
Hi Marius,
I have resolved it by adding a ruby filter to split string by ',' in logstash.conf.
Thanks,
Cherie
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 15, 2019, 11:48am UTC](https://discuss.elastic.co/t/resolved-kinaba7-0-terms-aggregration-doesn-t-aggregrate-by-individual-values-in-array/190366/4 "2019-08-15T11:48:31Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.