Some index string fields not appearing in visualization aggregation

Elastic Stack Kibana
1

Hi,

I was using Kibana 4.5 and I used to generate pie charts, and split them using Aggregation on field names. Now I switched to Kibana GA 5.0.0 and when I try to do the same procedure, only 3 of my several string fields are appearing when I try to Split Slices using Aggregation > Terms. I am using custom template in ES output of Logstash, but everything was fine in Kibana 4.5. Why is this happening? Somebody tell me how to fix this?

Thanks in advance..

2

could you please paste your mappings ?

make sure you are using keyword for strings (used to be not_analyzed), perhaps templates/mappings haven’t been updated accordingly

3

Hi @ppisljar

{
	"template": "mylogs-*",
	"mappings": {
		"_default_": {
			"_all": {
				"enabled": false
			},
			"properties": {
				"field1": {
					"type": "string"
				},
				"field2": {
					"type": "string"
				},
				"field3": {
					"type": "string"
				},
				"field4": {
					"type": "string"
				},
				"field5": {
					"type": "string"
				},
				"@version": {
					"type": "string"
				},
				"fielda": {
					"index": "not_analyzed",
					"type": "string"
				},
				"field6": {
					"type": "string"
				},
				"field7": {
					"type": "string"
				},
				"@timestamp": {
					"format": "strict_date_optional_time||epoch_millis",
					"type": "date"
				},
				"timea": {
					"format": "strict_date_optional_time||epoch_millis",
					"type": "date"
				},
				"server_ip": {
					"index": "not_analyzed",
					"type": "string"
				},
				"fieldb": {
					"index": "not_analyzed",
					"type": "string"
				},
				"request": {
					"type": "string"
				},
				"timeb": {
					"format": "strict_date_optional_time||epoch_millis",
					"type": "date"
				},
				"time_taken": {
					"type": "double"
				}
			}
		}
	}
}
4

and which 3 fields are actually appearing under the term split ?

5

fielda, fieldb, and server_ip

6

@ppisljar , do u have any solution?

7

only not_analyzed fields will show up, so you will have to update your mapping

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.