Some index string fields not appearing in visualization aggregation


#1

Hi,

I was using Kibana 4.5 and I used to generate pie charts, and split them using Aggregation on field names. Now I switched to Kibana GA 5.0.0 and when I try to do the same procedure, only 3 of my several string fields are appearing when I try to Split Slices using Aggregation > Terms. I am using custom template in ES output of Logstash, but everything was fine in Kibana 4.5. Why is this happening? Somebody tell me how to fix this?

Thanks in advance..


(Peter Pisljar) #2

could you please paste your mappings ?

make sure you are using keyword for strings (used to be not_analyzed), perhaps templates/mappings haven’t been updated accordingly


#3

Hi @ppisljar

{
	"template": "mylogs-*",
	"mappings": {
		"_default_": {
			"_all": {
				"enabled": false
			},
			"properties": {
				"field1": {
					"type": "string"
				},
				"field2": {
					"type": "string"
				},
				"field3": {
					"type": "string"
				},
				"field4": {
					"type": "string"
				},
				"field5": {
					"type": "string"
				},
				"@version": {
					"type": "string"
				},
				"fielda": {
					"index": "not_analyzed",
					"type": "string"
				},
				"field6": {
					"type": "string"
				},
				"field7": {
					"type": "string"
				},
				"@timestamp": {
					"format": "strict_date_optional_time||epoch_millis",
					"type": "date"
				},
				"timea": {
					"format": "strict_date_optional_time||epoch_millis",
					"type": "date"
				},
				"server_ip": {
					"index": "not_analyzed",
					"type": "string"
				},
				"fieldb": {
					"index": "not_analyzed",
					"type": "string"
				},
				"request": {
					"type": "string"
				},
				"timeb": {
					"format": "strict_date_optional_time||epoch_millis",
					"type": "date"
				},
				"time_taken": {
					"type": "double"
				}
			}
		}
	}
}

Expected fields not available in kibana visualation
(Peter Pisljar) #4

and which 3 fields are actually appearing under the term split ?


#5

fielda, fieldb, and server_ip


#6

@ppisljar , do u have any solution?


(Peter Pisljar) #7

only not_analyzed fields will show up, so you will have to update your mapping
https://www.elastic.co/guide/en/elasticsearch/guide/current/mapping-intro.html


Where to add the specified code?
Where to add the specified code?
(system) #8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.