2 years ago

Category: Data

August 29th 2020Elasticsearch 5 min read Learn how to change the status of a text field from non-aggregatable to aggregatable. Firstly, If you would like to find out why you may want to make a text field aggregatable please click https://help.logit.io/en/articles/3549276-why-would-i-make-a-text-field-in-elasticseach-and-kibana-aggregatable.

You can see that the current mapping type is text, you can't aggregate on a text field type.

PUT _template/logstash_msg_keyword {"order" : 4, "version" : 60001, "index_patterns" : ["logstash-*"], "settings" : {"index" : {"refresh_interval" : "5s"} }, "mappings" : {"_default_" : {"dynamic_templates" : [{ "message_field" : {"path_match" : "message", "match_mapping_type" : "string", "mapping" : {"type" : "text", "norms" : false, "fields" : {"keyword" : {"type" : "keyword", "ignore_above" : 2048 }} }} }, {"string_fields" : {"match" : "*", "match_mapping_type" : "string", "mapping" : {"type" : "text", "norms" : false, "fields" : {"keyword" : {"type" : "keyword", "ignore_above" : 256 }} }} }], "properties" : {"@timestamp" : {"type" : "date"}, "@version" : {"type" : "keyword"}, "geoip" : {"dynamic" : true, "properties" : {"ip" : {"type" : "ip"}, "location" : {"type" : "geo_point"}, "latitude" : {"type" : "half_float"}, "longitude" : {"type" : "half_float"} }} }} }, "aliases" : { }}