Trouble to add new index

Elastic Stack Kibana
1

Hi ! I'm now setting kibana 5.0.1 for visualize nginx access log.
But I'm in trouble, so please help.

When I tried to define new index pattern from management menu, original field name was added strange word ".keyword" .(I uploaded Screenshot)

What does ".keyword" mean ?Please tell me how to remove that.

I think Nginx log is no problem.Because this nginx log have been collected and normaly visualyzed at another kibana3.x server.

2

.keyword fields are automatically created for analyzed string fields. The problem with analyzed strings was (in the older versions) that if you visualize them then each word gets counted once. So for example if you have a field saying "not good" and you have 3 matches then in the visualization you would find 3 matches for "not" and 3 for "good". To solve this problem one had to map the field in elasticsearch as not analyzed before indexing.
To solve this problem the .keyword field is created automatically which is a not analyzed string and it is the only field which can be used visualizations (in searches the normal field which is analyzed will be used).

1 Like
3

Thank you for the detailed explanation.

I want to treat a few items as a number. (like a request_time)

Is it possible to resolve by defining mapping using API or file?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.