1

I generate the hash field in Logstash similar to this:

{components: ["foo", "bar", "foo bar"]}

I pass it to Elasticsearch and when I want to get the count of occurencies of each string I have only foo and bar in Kibana as they foo bar is splitted.

How to disable this split so I can get real values ? For now I'm using gsub to change all spaces to underscores but it's not the goal.

Dawid Gosławski
  • 2,028
  • 1
  • 18
  • 25
  • 1
    Logstash adds by default a `.raw` subfield to the index fields. And this `.raw` subfield is `not_analyzed`. In your case, you could search `components.raw`. – Andrei Stefan Sep 23 '15 at 14:53
  • @AndreiStefan I do not have any .raw fields, is it valid only for logstash-* indexes ? I use my own index like "statistics-*". I have Kibana 4.1.1, Logstash 1.5.4, Elasticsearch 1.5.2 – Dawid Gosławski Sep 23 '15 at 16:22
  • Ok I found it in kopf, there is some default mapping to create raw field only if index is logstash-* :) Thanks – Dawid Gosławski Sep 23 '15 at 16:25

0 Answers0