Visualizing Analysed fields

[Pieter_Agenbag]

Hi.

I finally started the arduous task of upgrading/porting to Elastic Stack 5.0 (from ES 1.7 & Kibana 4.1) ... needless to say theres been some issues , mostly with my elasticsearch mappings etc., but finally seem to have all my data migrated.

However , Kibana 5.1 does not seem to allow me to visualise analysed fields anymore ? I know its preferable to use not_analysed fields / doc values, but surely Kibana can decide to completely unsupport analysed fields ?

I have a field in the format "part1-number-part2" for which I created a custom analyser which splits it into
myfield (the original analysed text)
myfield.raw (nor analysed version of full text)
myfield.part1 (the front part of the value)
myfield.part2 (the back piece of the value)

I have several visualisations that depend on either part1 or part2 only... but Kibana complains that "Saved "field" parameter is now invalid. Please select a new field."

And in the terms drop down it now only lists all my *.raw fields (under the strings section) ?

Help.
Please.

P.S. Initially I imported my data with the (slightly modified but) the same es 1.7 string type mappings. But I have tried changing the mapping of the fields to "text" and "keyword" for analysed and not_analysed fields , but it didnt make any difference.

PP.S. I can query the part1 and part2 fields straight from es (or filter on it in the discover screen , with a text filter at the top. i.e. myfield.part1:mypart1value), so I know the analyser still works and the field is available.

[Pieter_Agenbag]

In the Kibana Management -> Index patterns screen , I can see ALL fields marked as analyzed , are also lacking the " aggregatable" tick .

Do I need to map something different to allow an analyzed field to be aggregatable ?

[Pieter_Agenbag]

Ok, figured it out. Apparently in new(er) versions of Elasticsearch you have to explicitly set fielddata = true in your mapping if you want to make an analyzed field aggregatable.

"message_id": {
	"type": "text",
	"fields": {
		"mnemonic": {
			"type": "text",
			"analyzer": "cisco_mnemonic",
			"fielddata": true
		},
		"facility": {
			"type": "text",
			"analyzer": "cisco_facility",
			"fielddata": true
		},
		"raw": {
			"type": "keyword"
		}
	},
	"analyzer": "cisco",
	"fielddata": true
}