Taking string as separate token while Visualizing on KIbana

(Gaurav Harsola) #1


I have country field in my elastic search index with value : san francisco,mountain view
But when i visualize pie chart on kibana using country field then it give me chart for both 'san' and 'francisco' rather than giving single one for 'san francisco'.

Please help me out.


(Magnus Bäck) #2

The field name is analyzed, i.e. split into tokens. The field you use for such aggregations should be non-analyzed. If you don't want to make the field itself non-analyzed you can create subfields that are non-analyzed and use those for aggregations. Check the documentation.

(Gaurav Harsola) #3

input {
file {
path => "/home/logGenerator.log"
start_position => "beginning"
filter {
grok {
match => { "message" => '[%{TIMESTAMP_ISO8601:timestamp}] %{NUMBER:TxID} %{WORD:loglevel} (?\d{4}-\d{4}-\d{4}) %{BASE10NUM:amount} %{WORD:method} %{WORD:Merchant} %{NUMBER:pinCode} "(%{GREEDYDATA:msg})"'}

output {
stdout { codec => rubydebug }
elasticsearch {
hosts => "localhost:9200"
index => "fraud1"

Let suppose this is my conf file .How i will mention my columns as analysed or non anaylsed .

(Magnus Bäck) #4

That configuration needs to be done on the Elasticsearch side. As I said, read the documentation about mappings and index templates. I'm happy to help with questions but you have to do your part.

(Gaurav Harsola) #5

Thanks Magnus ! I got the solution and it is working fine.

Thanks for your support !


(system) #6