# Weird Result ElasticSearch Facets with Apache Log field:PATH **URL:** \ **Category:** Elasticsearch\ **Created:** [July 16, 2013, 8:31am UTC](https://discuss.elastic.co/t/weird-result-elasticsearch-facets-with-apache-log-field-path/12804 "2013-07-16T08:31:19Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Atrus\_Klaus](https://avatars.discourse-cdn.com/v4/letter/a/91b2a8/32.png) [@Atrus\_Klaus](https://discuss.elastic.co/u/Atrus_Klaus)\ **Post date:** [July 16, 2013, 8:31am UTC](https://discuss.elastic.co/t/weird-result-elasticsearch-facets-with-apache-log-field-path/12804/1 "2013-07-16T08:31:19Z")
Hi there, I put Apache Log access to E.S for searching and do some statistics. My logs example is something like this : _curl "localhost:9200/logstash-2013.07.16/\_search?pretty" -d '{"size":4}'_ { "took" : 3, "timed\_out" : false, "\_shards" : { "total" : 5, "successful" : 5, "failed" : 0 }, "hits" : { "total" : 45, "max\_score" : 1.0, "hits" : [ { "\_index" : "logstash-2013.07.16", "\_type" : "fluentd", "\_id" : "dCi2ALWDSj6tA4I0W6kZnQ", "\_score" : 1.0, "\_source" : {"host":"10.0.0.1","user":null,"method":"GET","path":"/somepath01/somefile01.html","code":200,"size":12,"referer":null,"agent":"curl/7.19.7 (x86\_64-unknown-linux-gnu) libcurl/7.19.7 NSS/3.12.7.0 zlib/1.2.3 libidn/1.18 libssh2/1.2.2","@timestamp":"2013-07-16T11:25:01+07:00"} }, { "\_index" : "logstash-2013.07.16", "\_type" : "fluentd", "\_id" : "udCTJUP8Sce5N-A5QSdCDw", "\_score" : 1.0, "\_source" : {"host":"10.0.0.2","user":null,"method":"GET","path":"/somepath02/somefile02.html","code":200,"size":12,"referer":null,"agent":"curl/7.19.7 (x86\_64-unknown-linux-gnu) libcurl/7.19.7 NSS/3.12.7.0 zlib/1.2.3 libidn/1.18 libssh2/1.2.2","@timestamp":"2013-07-16T11:25:02+07:00"} }, { "\_index" : "logstash-2013.07.16", "\_type" : "fluentd", "\_id" : "Yghj0YQtTYWaS\_kGy8T7YQ", "\_score" : 1.0, "\_source" : {"host":"10.0.0.3","user":null,"method":"GET","path":"/somepath03/somefile03.html","code":200,"size":12,"referer":null,"agent":"curl/7.19.7 (x86\_64-unknown-linux-gnu) libcurl/7.19.7 NSS/3.12.7.0 zlib/1.2.3 libidn/1.18 libssh2/1.2.2","@timestamp":"2013-07-16T11:25:03+07:00"} }, { "\_index" : "logstash-2013.07.16", "\_type" : "fluentd", "\_id" : "WkrnKPd5Sc2qvE1fmRuEDA", "\_score" : 1.0, "\_source" : {"host":"10.0.0.4","user":null,"method":"GET","path":"/somepath04/somefile04.html","code":200,"size":12,"referer":null,"agent":"curl/7.19.7 (x86\_64-unknown-linux-gnu) libcurl/7.19.7 NSS/3.12.7.0 zlib/1.2.3 libidn/1.18 libssh2/1.2.2","@timestamp":"2013-07-16T11:25:04+07:00"} } ] } } Now I want to list the top IPs (field:_host_) which occurs most in the log, so I use the facets query : _curl "localhost:9200/logstash-2013.07.16/\_search?pretty" -d '{"facets":{"Top IP":{"terms":{"field":"host"}}}}'_ "facets" : { "Top IP" : { "\_type" : "terms", "missing" : 0, "total" : 45, "other" : 0, "terms" : [ { "term" : "10.0.0.9", "count" : 9 }, { "term" : "10.0.0.8", "count" : 8 }, { "term" : "10.0.0.7", "count" : 7 }, { "term" : "10.0.0.6", "count" : 6 }, { "term" : "10.0.0.5", "count" : 5 }, { "term" : "10.0.0.4", "count" : 4 }, { "term" : "10.0.0.3", "count" : 3 }, { "term" : "10.0.0.2", "count" : 2 }, { "term" : "10.0.0.1", "count" : 1 } ] } } The result is perfect ! E.S did work well. Now I want to do the same thing with field:_path_ to list the top most access-ed URL. _curl "localhost:9200/logstash-2013.07.16/\_search?pretty" -d '{"facets":{"Top URL":{"terms":{"field":"path"}}}}'_ "facets" : { "Top IP" : { "\_type" : "terms", "missing" : 0, "total" : 135, "other" : 28, "terms" : [ { "term" : "html", "count" : 45 }, { "term" : "somepath09", "count" : 9 }, { "term" : "somefile09", "count" : 9 }, { "term" : "somepath08", "count" : 8 }, { "term" : "somepath07", "count" : 7 }, { "term" : "somefile08", "count" : 7 }, { "term" : "somepath06", "count" : 6 }, { "term" : "somefile07", "count" : 6 }, { "term" : "somepath05", "count" : 5 }, { "term" : "somefile06", "count" : 5 } ] } } This time, the result is weird. It should be like this : "term" : " /somepath05/somefile05.html","count" : 5 I guest E.S have some errors with the forward slash "/" in the _path_ field. I don't know how to fix this. Could you pro show me the problem and help me to fix this. Many appreciates. Atrus@ -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![sanmar](https://avatars.discourse-cdn.com/v4/letter/s/7ba0ec/32.png) [@sanmar](https://discuss.elastic.co/u/sanmar)\ **Post date:** [July 16, 2013, 9:01am UTC](https://discuss.elastic.co/t/weird-result-elasticsearch-facets-with-apache-log-field-path/12804/2 "2013-07-16T09:01:47Z")
The standard tokenizers index your "path" field in many term (word) where "/" char is like a separator. I'm not really sure that's the right solution but you can try another tokenizers, for example: [http://www.elasticsearch.org/guide/reference/index-modules/analysis/whitespace-tokenizer/](http://www.elasticsearch.org/guide/reference/index-modules/analysis/whitespace-tokenizer/) Other "skilled" suggestions are appreciated ---
**Author:** ![Christian\_Th](https://avatars.discourse-cdn.com/v4/letter/c/f14d63/32.png) [@Christian\_Th](https://discuss.elastic.co/u/Christian_Th)\ **Post date:** [July 16, 2013, 9:02am UTC](https://discuss.elastic.co/t/weird-result-elasticsearch-facets-with-apache-log-field-path/12804/3 "2013-07-16T09:02:49Z")
Hi Atrus, can you create a mapping for the field "path", before indexing? It should be "not\_analyzed". After that, your facetting should work. You can have a look how to configure "not\_analyzed" fields, here [http://www.elasticsearch.org/guide/reference/mapping/core-types/](http://www.elasticsearch.org/guide/reference/mapping/core-types/). The path part of your mapping could look like .... "path": { "type": "string", "index": "not\_analyzed" } .... Greetings Christian -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![Atrus\_Klaus](https://avatars.discourse-cdn.com/v4/letter/a/91b2a8/32.png) [@Atrus\_Klaus](https://discuss.elastic.co/u/Atrus_Klaus)\ **Post date:** [July 17, 2013, 2:21am UTC](https://discuss.elastic.co/t/weird-result-elasticsearch-facets-with-apache-log-field-path/12804/4 "2013-07-17T02:21:20Z")
Thank you both for your reply ! It looks like that the Christian's way is more simpler. I did try and it worked perfectly : facets" : { "Top path" : { "\_type" : "terms", "missing" : 0, "total" : 21, "other" : 0, "terms" : [ { "term" : "/somepath06/somefile06", "count" : 6 }, { "term" : "/somepath05/somefile05", "count" : 5 }, { "term" : "/somepath04/somefile04", "count" : 4 }, { "term" : "/somepath03/somefile03", ... I have 2 more futhur questions : - is it possible to update the current indexed field from _analyzed_ to \* not\_analyzed\* without re-create the index ? - if the upper question is not possible, how can I config the E.S to default to use _not\_analyzed_ for string type instead of _analyzed_ ? Atrus@ -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![Ivan](https://avatars.discourse-cdn.com/v4/letter/i/df788c/32.png) [@Ivan](https://discuss.elastic.co/u/Ivan)\ **Post date:** [July 17, 2013, 5:08pm UTC](https://discuss.elastic.co/t/weird-result-elasticsearch-facets-with-apache-log-field-path/12804/5 "2013-07-17T17:08:09Z")
1. It is not possible to update existing fields without re-indexing. 2. You can use dynamic templates for exactly that purpose. See the template\_2 example in the dynamic template documentation (scroll down): [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/guide/reference/mapping/root-object-type/) Cheers, Ivan On Tue, Jul 16, 2013 at 7:21 PM, Atrus Klaus [linuxbyexamples@gmail.com](mailto:linuxbyexamples@gmail.com)wrote: > Thank you both for your reply ! > > It looks like that the Christian's way is more simpler. I did try and it > worked perfectly : > > facets" : { > "Top path" : { > "\_type" : "terms", > "missing" : 0, > "total" : 21, > "other" : 0, > "terms" : [ { > "term" : "/somepath06/somefile06", > "count" : 6 > }, { > "term" : "/somepath05/somefile05", > "count" : 5 > }, { > "term" : "/somepath04/somefile04", > "count" : 4 > }, { > "term" : "/somepath03/somefile03", > ... > > I have 2 more futhur questions : > > - is it possible to update the current indexed field from _analyzed_ to \* > not\_analyzed\* without re-create the index ? > - if the upper question is not possible, how can I config the E.S to > default to use _not\_analyzed_ for string type instead of _analyzed_ ? > > Atrus@ > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 2:25am UTC](https://discuss.elastic.co/t/weird-result-elasticsearch-facets-with-apache-log-field-path/12804/6 "2017-07-06T02:25:53Z")