Visualizing multi-valued field in kibana using terms aggregation



I have multi-valued key "tags" as below.
"_source": {
"tags": "["aaa" , "bbb", "ccc"]",
"message": {
"test1": "asdasd",
"test2": "ddddd",

I need to visualize the above multi-valued key in kibana to see how many documents have each of these tags. I am trying to use "terms" Aggregation to visualize this multi-valued field with no success as "tags" appear as a single string "["aaa" , "bbb", "ccc"]" and not separately as "aaa" "bbb" and "ccc". I also tried using nested mapping for the "tags" with no success.
From my litle knowledge of ELK stack I understand I should be defining some type for "tags" but not sure which to use which will help me use "terms" aggregation for tags. Only other option I see is using mutiple key value pairs like tag1=aaa, tag2=bbb and so on, but that is not really helpful in my situation

Your help is much appreciated. Thanks

(Marius Dragomir) #2

you could merge the tags field to a string, make that field analysed by Elastic, then you will be able to do a terms aggregation on the tags field and it will show values for each tag.

(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.