Why the japanese characters(Kanji ) are separated in kibana visualization even though single word and field

Elastic Stack Kibana
1

Hi ,

I have csv data stored in ES through logstash , currently i able to load the index in Kibana and while display in discovery the data is shown correctly ( word by word in single field) but in the visualization when i added name field as term for aggregation character by character is coming as separate filed.

English words are split by each word but japanes words are split by each character or kanji.
I want the whole field as single .
How can i achieve this.

2

If you are using Logstash to index your data into Elasticsearch, there must be a <fieldname>.raw field, corresponding to every <fieldname> field in your index. While the string in <fieldname> is analyzed by Elasticsearch, the <fieldname>.raw field contains the original string in the <fieldname> field, as-is, un-analyzed.

Try aggregating by this <fieldname>.raw field.

3

Hi shaunak,
Thank you for your quick response .

Sorry i did not get any .raw for my current index. is there any setting to get raw field in ES.

4

if field name are in japanese can i get .raw ?
is there any restrictions for creating field name.

5

If i use field names as english fields then problem solved .

Thank you for your clue.

It will be great appreciated if we get raw fields for japanese titles(Field names)..

6

raw fileds are creating only if it is default index(logstash.xx.xx.xx) .
If we specify index name explicitly then raw fields are not created, so it is not the problem with language.

7

Hi, that's correct. The .raw fields are created if you use the default index in Logstash. The reason for this is that Logstash provides Elasticsearch with an index template with the appropriate mappings for all indices named logstash-*. You can see this template here: https://github.com/logstash-plugins/logstash-output-elasticsearch/blob/master/lib/logstash/outputs/elasticsearch/elasticsearch-template.json

If you decide to use an index name other than logstash-*, this template is not applicable, hence the .raw fields are not created automatically. You will need to provide an index template of your own, similar to the one provided by Logstash, matching the name(s) of your indices.

You can learn more about index templates in general over here: