CODEWITHSUNDEEP
elasticsearchkibana
Zeeshan
Zeeshan

Reputation: 12421

Using text field for aggregations in Elasticsearch

In am getting the following error in Kibana when I try to load my visualization.

Visualize: Fielddata is disabled on text fields by default. Set fielddata=true on [beat.name] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory.

So I tried adding unanalyzed keyword field with doc_values enabled for aggregations as per this LINK.

Since I am creating daily index I created a template:

PUT /_template/template_metricbeat_1
{
    "template": "*metricbeat*",
    "order": 1,
    "settings": {
        "number_of_shards": 5,
        "number_of_replicas": 1,
        "refresh_interval": "30s"
    },
    "mappings": {
        "metricsets": {
            "properties": {
                "beat.name": {
                    "type": "text",
                    "fields": {
                        "keyword": {
                            "type": "keyword"
                        }
                    }
                }
            }
        }
    }
}

But I have around fifty text field that would be used in creating visualization.

So my question is how do I add unanalyzed keyword field with all my fifty text field in one go?

Upvotes: 0

Views: 3575

Answers (1)

Andrei Stefan
Andrei Stefan

Reputation: 52368

The proper way of using the Beats in general is to use their own index templates, where each has its specific fields and configurations.

Specifically for Metricbeat, the template is here: https://github.com/elastic/beats/blob/v5.3.0/metricbeat/metricbeat.template.json

And documentation on how to get it and apply it is here: https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-template.html

Upvotes: 1

Related Questions