Terms aggregation on _all field in Kibana?


(Patrick Lam) #1

Perhaps I'm missing something, but from my understanding, the default search field for text for Kibana (in the search box) is essentially the _all field. However, I can't seem to do a terms or significant terms aggregation on the _all field in the visualizations for keyword suggestions. Is there a way to enable terms aggregations for the _all field? Or alternatively change the default search field for the search box?


(Mark Walkom) #2

_all is an analysed field, you don't want to agg on that.

What are you trying to achieve?


(Patrick Lam) #3

I just want to see the most common (or uniquely common) keywords in my text fields. I'm aware of the memory demands it takes on analyzed fields, but I think it's not an uncommon usage, especially if you keep the number of buckets to a reasonable size.

For example, the ES documentation on significant terms aggregations does suggest aggregations on free text fields as a potential use case.

https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-significantterms-aggregation.html#_use_on_free_text_fields


(system) #4