Timelion 5.0 split is not working for me

Elastic Stack Kibana
1

Hi guys, I'm having trouble with the Timelion plugin on Elastic 5.0. I was using Kibana 4.5.4 and had no issues with this query in timelion: .es(q=*,split="env.prd:2") to split all my documents by the key env.prd (it only has 2 possible values)

This is my query in Kibana 4.5.4:

Data OK 4.png730×312 17 KB

And on Kibana 5

Data NOK 5.png702×321 3.93 KB

Any ideas what could be wrong? Has the syntax changed for Kibana 5?

2

The syntax should be the same, a quick test shows it working for me. Did your field name change? I see "env.prd" and env_prd". The blank chart is consistent for me with a field name that doesn't exist.

3

Hi Jon, yes, sorry I forgot to mention that I re-indexed my data and now the field env_prd is called env.prd. Here you can see that there is data for this field yet the split argument doesn't like it:

Just in case I tried with another field that doesn't contain dots but I get the same result:

4

Is your field analyzed/mapped as as text field? I was able to make a silent failure under those circumstances. Specifying an index= in my function made the error show up, if you're able to reproduce that.

5

Not sure how to use the index parameter, I tried this:

.es(q=*, index="logstash-*", split="env.prd:2")

but it gives me an error "Timelion: Error: in cell #1: [illegal_argument_exception] Fielddata is disabled on text fields by default. Set fielddata=true on [env.prd] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory."

This is the field mapping, it's text and analyzed:

      "env" : {
        "properties" : {
          "prd" : {
            "type" : "text",
            "norms" : false,
            "fields" : {
              "keyword" : {
                "type" : "keyword"
              }
            }
          },
6

Okay, you'll want to split on the keyword field:
.es(q=, index="logstash-", split="env.prd.keyword:2")

env.prd is ran through elasticsearch's analyzer, which from the error text is disabled by default. If this works for you, I'll open up an issue for not showing an error without an index.

1 Like
7

Yes!!!!!! That's it!

So it seems that version 5 introduced this requirement since on Kibana 4.5.4 I didn't have to use the not_analyzed value, the analyzed field worked fine without expliciting the index...

Thank you very much for your help!

1 Like
8

Glad to hear it, we have an issue for the error messsage being tracked here