Ugrade visualizations from 2.4 to 5.2

Ok,

I am building a new cluster for 5.2 and I undertand there are lots of little breaking changes that are making my life difficult.

Ok, I came across the size:0 is not no longer valid simple search and replace on json export of kibana index, no problem done.

but now it seems the field name is getting the extension of .keyword appended to my fields.

and this is breaking all 600ish of my visualizations. I was going to search and replace to add the "field":"environment" with "field": "environment.keyword" but then noticed that Integers do not have any extension.

I have not migrated my current old mappings over yet. Would this be a result of using the default one ???? But I presume keyword and text will be needed instead of "string" I just want to know if I have to figure out how to deal with .keyword so I can fix my visualizations. I really don't want to edit +600 of them

---- Just showing that adding .keyword fixes my Vis
2.4 Visualization

{
"_index": ".kibana",
"_type": "visualization",
"_id": "S5A-Apache-Top-N-Full-URLs-by-HTTP-Status-Code",
"_score": 1,
"_source": {
"title": "S5A Apache Top N Full URLs by HTTP Status Code",
"visState": "{"title":"S5A Apache Top N Full URLs by HTTP Status Code","type":"table","params":{"perPage":3,"showPartialRows":false,"showMeticsAtAllLevels":false},"aggs":[{"id":"1","type":"count","schema":"metric","params":{}},{"id":"2","type":"terms","schema":"bucket","params":{"field":"rawrequest","size":5,"order":"desc","orderBy":"1","customLabel":"URL"}},{"id":"3","type":"terms","schema":"split","params":{"field":"response","size":0,"order":"desc","orderBy":"1","customLabel":"Response","row":true}}],"listeners":{}}",
"uiStateJSON": "{}",
"description": "",
"version": 1,
"kibanaSavedObjectMeta": {
"searchSourceJSON": "{"index":"s5a-*","query":{"query_string":{"query":"type:apache","analyze_wildcard":true}},"filter":}"
}
}
}

Fixes to 2.4 visual in 5.2 I had to update changes "field":"response.keyword","size":100. Now it works fine

{
"_index": ".kibana",
"_type": "visualization",
"_id": "S5A-Apache-Top-N-Full-URLs-by-HTTP-Status-Code",
"_score": 1,
"_source": {
"title": "S5A Apache Top N Full URLs by HTTP Status Code",
"visState": "{"title":"S5A Apache Top N Full URLs by HTTP Status Code","type":"table","params":{"perPage":3,"showPartialRows":false,"showMeticsAtAllLevels":false},"aggs":[{"id":"1","type":"count","schema":"metric","params":{}},{"id":"2","type":"terms","schema":"bucket","params":{"field":"rawrequest","size":5,"order":"desc","orderBy":"1","customLabel":"URL"}},{"id":"3","type":"terms","schema":"split","params":{"field":"response.keyword","size":100,"order":"desc","orderBy":"1","customLabel":"Response","row":true}}],"listeners":{}}",
"uiStateJSON": "{}",
"description": "",
"version": 1,
"kibanaSavedObjectMeta": {
"searchSourceJSON": "{"index":"s5a-*","query":{"query_string":{"query":"type:apache","analyze_wildcard":true}},"filter":}"
}
}
}

Yes, the .keyword extension is part of the new default mappings for JSON strings in index requests. If you want the not-analyzed version of a string field you either need to setup your mappings to make the default values keyword type, or convert your visualizations over to the .keyword fields.

I was hoping that would not be the answer. this is really annoying since we extensively use terms ,

Thanks

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.