Using text field for aggregations in Elasticsearch

Question

In am getting the following error in Kibana when I try to load my visualization.

Visualize: Fielddata is disabled on text fields by default. Set fielddata=true on [beat.name] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory.

So I tried adding unanalyzed keyword field with doc_values enabled for aggregations as per this LINK.

Since I am creating daily index I created a template:

PUT /_template/template_metricbeat_1
{
    "template": "*metricbeat*",
    "order": 1,
    "settings": {
        "number_of_shards": 5,
        "number_of_replicas": 1,
        "refresh_interval": "30s"
    },
    "mappings": {
        "metricsets": {
            "properties": {
                "beat.name": {
                    "type": "text",
                    "fields": {
                        "keyword": {
                            "type": "keyword"
                        }
                    }
                }
            }
        }
    }
}

But I have around fifty text field that would be used in creating visualization.

So my question is how do I add unanalyzed keyword field with all my fifty text field in one go?

Did you use the default metricbeat template? The beat.name field is already keyword there: github.com/elastic/beats/blob/v5.3.0/metricbeat/… — Andrei Stefan
Thanks, it worked. Can you add it as an answer so that I can accept it. — Zeeshan

Andrei Stefan Andrei Stefan · Accepted Answer · 2017-04-20T09:41:09

The proper way of using the Beats in general is to use their own index templates, where each has its specific fields and configurations.

Specifically for Metricbeat, the template is here: https://github.com/elastic/beats/blob/v5.3.0/metricbeat/metricbeat.template.json

And documentation on how to get it and apply it is here: https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-template.html

Using text field for aggregations in Elasticsearch

1 Answers