String values not showing up in Visualize 6.5

Elastic Stack Kibana
1

I am trying to get two string values to show up under visualize as well as 2 timestamp values. the two string fields needed are site and klocker_app_name.

to my knowledge, in order for a string to be visualized, it needs to be a keyword. After checking my index mappings, I see

 "klocker_app_name" : {
            "type" : "text",
            "fields" : {
              "keyword" : {
                "type" : "keyword",
                "ignore_above" : 256
              }
            }
          },

and

"site" : {
            "type" : "text",
            "fields" : {
              "keyword" : {
                "type" : "keyword",
                "ignore_above" : 256
              }
            }
          },

I see for a string to be in visualize it needs a .raw field as well, but it was to my knowledge that this is done dynamically

2

Hi @jwalls,

The mappings show that there is a text indexed field klocker_app_name and a keyword indexed field klocker_app_name.keyword. If you want to build visualizations using the terms aggregation, you can use the klocker_app_name.keyword field, your data is already correctly indexed for that.

You don't need a .raw field to visualize something, these names just come from different mappings - The important property is the type of a field.

3

Thank you, I realized I had to "refresh fields list" in the kibana management tab. as it was still only allowing .raw fields. Once I refreshed the list, it allowed .keyword fields.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.