Unable to make a field aggregatable in kibana/ES

[sid_nikhil (Nikhil Kumar)]

I have a field called "message" . I need to make it as aggregatable. I am unable to do so .
Can someone please suggest how to achieve that.

I have already followed the steps in the following Link .. still not able to make message field aggregatable

Unable to make a field aggregatable in kibana

I did this in Dev tools PUT /filebeat { "mappings": { "_doc": { "properties": { "message": { "type": "keyword" } } } } } But still message field is not aggregatable [Capture_kibana_aggregation] If my field is message , do you mean i should use message.doc_values This is my painless script to extract last word from message: String parts = /-/.split(doc['message'].value); return parts[-1] …

Can someone please suggest how to achieve that.

[Bill_McConaghy]

Take a look at the answer to this forum post for advice on how to do this: Can I make string field as aggregatable?

[1119495293 (锋子)]

refresh