Timelion es() metric: field data is disabled on text fields

Hey,
I have log file that i am trying to index and plot the data with timelion.
When i am trying to do a query with es() and use the metric field on one of my data fields i get this error:

I dont understand how should i index the data in order to be able to use it as a metric.
Here is some example line from my log file :

1510518652 5 6 7
1510518660 5 6 7
1510518670 10 15 20
1510518675 10 15 20

I use filebeat and logstash to index this log file. My logstash.conf looks like:

input {
beats {
port => "5043"
}
}
filter {
grok {
match => {"message" => "%{NUMBER:epoch} %{NUMBER:x} %{NUMBER:y} %{NUMBER:z}"}
}
date {
match => ["epoch", "UNIX"]
}
}
output {
stdout { codec => rubydebug }
elasticsearch {
hosts => ["elasticsearch:9200"]
user => elastic
password => changeme
}
}

And here is an example of the indexed data:

Can you please point me on any thing that will help me to use x,y,z as a metric when i am doing es() query with timelion ?

Thanks !

@lidavid if you go to Management -> Index Patterns in Kibana, and select your Index Pattern,
do you see "string" in the "type" column for x, y, and z? If so, I'd recommend to start by reading https://www.elastic.co/blog/logstash_lesson_elasticsearch_mapping which explains how to specify the Elasticsearch mappings with Logstash and the grok filter to index these values as numbers, which can then be used in aggregations.

That Really helped me. Thank you !!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.