Visualizing an analysed field intentionally

(Peter Gurney) #1

Hi all

banging my head against a wall here hope someone can help.
I have a field that gets populated with content like this:
100000 2 111/udp; 100000 2 111/udp; 100021 1 970/udp; 100021 3 970/udp; 100021 4 970/udp; 100021 1 970/udp; 100021 3 970/udp; 100021 4 970/udp; 100024 1 191/udp; 100024 1 191/udp;

I want to create visualizations on this but with each bit of data between the ;'s counted individually.
I have found countless posts from people that were having issues but in reverse they wanted to stop their data being split and the answer is usually use the .raw version of their field so i figured id try the opposite and stop using the .raw and just used the analysed field and it will split it for me .... that didnt work I get an error "Visualize: Field data loading is forbidden on [fieldname]" so seems although you get the warning you shouldn't really use this field I can't anyway.

any suggestion on how I can get them split to be counted on their own ?

(Mark Walkom) #2

You need to split things before you send them to ES.

(system) #3