Hi Stéphane, thanks for the explanation! I tried to recreate your use case and here's what I came up with. First, I created a bunch of documents with the
links.raw property, which is an array of various links (e.g. "twitter.com", "email@example.com"). Then I created a bar chart visualization with this kind of configuration:
As you can see, this gets some good-looking results BUT they're incorrect! Our query is looking at the occurrence of each individual item within the
links.raw array, instead of treating the array as a single unit.
In order to get the kind of visualization you want, I had to create a scripted field (Management > Index Patterns > Scripted Fields). I named it
formattedLinks and configured it like this:
This concatenates the values in the array. Then I changed my visualization to aggregate on this scripted field instead of
links.raw. Now I got a visualization more inline with what you're looking for. The only challenge is if the order of your values isn't deterministic (e.g. you see arrays of both ["foo", "bar"] and ["bar", "foo"], then you will need to sort them, too. If you're doing that then I recommend looking at something like Logstash to format this data at ingest time (instead of at query time), which will be much more efficient and faster.
Does this help?