Right IPv6 Field,Wrong Visualize Display In Kibana

Roger_Hsu · July 31, 2015, 9:00am

Hi,

I'm newbie on ELK Stack and test it about a Month ago.
Got a issue with IPv6 field with many colon( ,when visualize like this

But search this field is right

Display full IPv6 string,no separate by colon( in visualize will better!
Have any idea fix it?
Thanks!

warkolm · July 31, 2015, 9:02am

Use the .raw version of the field instead.

Roger_Hsu · August 3, 2015, 3:02pm

Thank you,warkolm.
Although I can't find .raw file and have not fix this issue,because the indices using bulk api and import from another application,bypass Logstash.
But I know if I can change mapping index to not_analyzed when bulk api not auto mapping. After "agg" the IPv6 format will display correctly.
Final stats > NOT FIX!

Roger_Hsu · August 4, 2015, 5:14am

Problem resolved.
Use Default Mapping let the field into not_analyzed!