Visualizing multi-valued field in kibana using terms aggregation

Hi,

I have multi-valued key "tags" as below.
{
"_source": {
"tags": "["aaa" , "bbb", "ccc"]",
"message": {
"test1": "asdasd",
"test2": "ddddd",
}
}

I need to visualize the above multi-valued key in kibana to see how many documents have each of these tags. I am trying to use "terms" Aggregation to visualize this multi-valued field with no success as "tags" appear as a single string "["aaa" , "bbb", "ccc"]" and not separately as "aaa" "bbb" and "ccc". I also tried using nested mapping for the "tags" with no success.
From my litle knowledge of ELK stack I understand I should be defining some type for "tags" but not sure which to use which will help me use "terms" aggregation for tags. Only other option I see is using mutiple key value pairs like tag1=aaa, tag2=bbb and so on, but that is not really helpful in my situation

Your help is much appreciated. Thanks

1 Like

you could merge the tags field to a string, make that field analysed by Elastic, then you will be able to do a terms aggregation on the tags field and it will show values for each tag.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.