DevOps Articles

Why would I make a text field in Elasticseach and Kibana aggregatable?

What are the benefits of aggregating text fields? Text fields, by default, are analysed before indexing so that a value like "red car" can be found by searching for both "red" and "car".

Making a text field aggregatable means that all values of all documents for the text field are loaded into memory.

In our example of red car, an aggregation on the field will return a "red" bucket and a "car" bucket. Any document with a mention of the word red in this text field will be added to the "red" bucket and the same for the word car and the "car" bucket.