Why is data considered differently for different indexes in kibana


For an index A, the field EventTemplateName value is CustomEvent and this is same for all the documents, and in kibana graphs, its showing in lower case customevent.

Now, I changed my indexing strategy to weekly indexes, and suddenly for the new indexes, it started showing as CustomEvent, in the graph, and it is shown as different group. So, its not being aggregated as it is considered as different group.

But, the actual value in the ES document is always, CustomEvent, So is there any setting I should change in Kibana? or that is something to do with elastic search?

@nethis if you compare the mappings between the two indexes are the settings for that field the same? For your convenience, here's a link for how to retrieve the mappings for an index: https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-get-mapping.html

1 Like

Got the issue here, Analyzed string is NOT case sensitive and Not Analyzed string is Case sensitive

@nethis I'm glad to hear that you were able to figure out the issue, and thank you for following up.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.