Terms Aggregation of long value

Elastic Stack Elasticsearch
1

Hi,

I've created data table visualization with terms aggregation and I saw the aggregation isn't working on some values, I think it's connected to the long but not sure.
For example, the following value is aggregatable:

"text": "#auto #error bgs failed to send feedback, however run itself completed"

and the following value is not aggregatable:

"text": "#auto #error \n********\n* Uncaught EXCEPTION. Message: TypeError: r is not a function. (In 'r(function(){},function(){},"CarizmaExtensions","updateZappTokens",[{tokens:t,hotViewName:e}])', 'r' is undefined)\n* Source: https://app.carizma.com/v18/app.7890ab6d49b18fe01a87.js\n* Line:column: [84:28287]\n* Error: {"line":84,"column":28287,"sourceURL":"https://app.carizma.com/v18/app.7890ab6d49b18fe01a87.js\"}\n* Previous log line before exception: CardsService - after putApprovalsFirst there are 0 cards\n********\n",

Do you have an idea why?

Thanks a lot

2

Sorry, I don't recognise any of those error messages. What software is producing those?
Can you simplify the problem down to an example CURL request and response to elasticsearch directly?

3

@Mark_Harwood
It's our internal software logs, consider it as a string value of the "text" key.
when I'm creating a data table with term aggregation of the "text" field the value of the second example (the long one) is not aggregatable.
Thanks.

4

Ah I see. Often there's a limit on field length for aggregatable values. See [1].
Not a logstash expert but I expect 256 is the default limit in an index mapping.

[1] ignore_above | Elasticsearch Reference [5.6] | Elastic

5

I think it's related to the mapping of the field. keyword\text ???
What is the parallel behavior of "type: string", "index: not_analyzed" on the new ES versions 5.x.x ?

6

type : keyword

7

Do the "text.keyword" field is already mapped as keyword?
Which field do I need to specify on the mapping- "text.keyword" or "text"?

"mappings": {
"feedbacks": {
"properties": {
"text": {
"type": "keyword"
}
}
}
}

or:

"mappings": {
"feedbacks": {
"properties": {
"text": {
"properties": {
"keyword": {
"type": "keyword"
} } } } }

8

Try testing explicit mapping for both text (type: text) and text.keyword (type: keyword) and see the problem persists with aggregation. These are called Multi-Fields. You set one field with multiple types to allow for different use/search scenarios.

The longer value may not be able to be aggregated due to length, but it would need to be keyword type for aggregation to work.

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.