# Visualize apache logs strange

**URL:** https://discuss.elastic.co/t/visualize-apache-logs-strange/58094
**Category:** Kibana
**Created:** [August 16, 2016, 5:35am UTC](https://discuss.elastic.co/t/visualize-apache-logs-strange/58094 "2016-08-16T05:35:13Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![emperor](https://avatars.discourse-cdn.com/v4/letter/e/a8b319/32.png) [@emperor](https://discuss.elastic.co/u/emperor)
#### Post date: [August 16, 2016, 5:35am UTC](https://discuss.elastic.co/t/visualize-apache-logs-strange/58094/1 "2016-08-16T05:35:13Z")

</div>

i have succefully configured apache logs to elk servers,but when i use the visualize (Vertical bar chart mode) to show the apache request url , it shows like this\_

 ![](https://us1.discourse-cdn.com/elastic/original/2X/b/b519b19e5b1a2da723eee7a60fff205eee5387b1.png)\_  
the correct result should like this ![](https://us1.discourse-cdn.com/elastic/original/2X/7/77a27579f1096a806135d277e1c8e87ed740d224.png)  
it seems when i use the query,it split the common url to lonely characters,

the query json  
{  
"size": 0,  
"query": {  
"filtered": {  
"query": {  
"query\_string": {  
"analyze\_wildcard": true,  
"query": "\*"  
}  
},  
"filter": {  
"bool": {  
"must": [  
{  
"range": {  
"@timestamp": {  
"gte": 1471321799018,  
"lte": 1471325399018,  
"format": "epoch\_millis"  
}  
}  
}  
],  
"must\_not":   
}  
}  
}  
},  
"aggs": {  
"3": {  
"terms": {  
"field": "RequestUrl",  
"size": 20,  
"order": {  
"\_count": "desc"  
}  
}  
}  
}  
}

hope to get a reply.....

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [August 16, 2016, 5:39am UTC](https://discuss.elastic.co/t/visualize-apache-logs-strange/58094/2 "2016-08-16T05:39:55Z")

</div>

You are using an analysed field in your aggregation, which is indicated by the yellow warning message in the visualisation builder. You will need to change the mapping for the field to not\_analyzed in order to aggregate on complete URLs.

---

<div class="post-metadata">

### Author: ![emperor](https://avatars.discourse-cdn.com/v4/letter/e/a8b319/32.png) [@emperor](https://discuss.elastic.co/u/emperor)
#### Post date: [August 16, 2016, 5:58am UTC](https://discuss.elastic.co/t/visualize-apache-logs-strange/58094/3 "2016-08-16T05:58:05Z")

</div>

> [@Christian\_Dahlqvist](#):
>
> not\_analyzed

does it support online mapping

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [August 16, 2016, 6:18am UTC](https://discuss.elastic.co/t/visualize-apache-logs-strange/58094/4 "2016-08-16T06:18:53Z")

</div>

I do not understand what you mean. Best way is to define an [index template](https://www.elastic.co/guide/en/elasticsearch/reference/2.3/indices-templates.html#multiple-templates) with the correct mapping. You will need to reindex the data though as it is not possible to change mapping for an existing field.

---

<div class="post-metadata">

### Author: ![emperor](https://avatars.discourse-cdn.com/v4/letter/e/a8b319/32.png) [@emperor](https://discuss.elastic.co/u/emperor)
#### Post date: [August 22, 2016, 6:11am UTC](https://discuss.elastic.co/t/visualize-apache-logs-strange/58094/5 "2016-08-22T06:11:13Z")

</div>

new question,there is a option host,some logstash agent get the empty values,only one get the real values,I define an index template to slove the not\_analyzed,  
what metod does the "host" use ? read the logstash agent hostname or some config?  
 ![](https://us1.discourse-cdn.com/elastic/original/2X/1/1277473b93c87397c06954a5c509005c2ef1352d.png)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:40pm UTC](https://discuss.elastic.co/t/visualize-apache-logs-strange/58094/6 "2017-07-06T13:40:44Z")

</div>