Search code examples
jsonkibanakibana-4elasticsearch

Kibana4: Analyzed string field warning

I have 3 JSON key value pairs in my document which I insert into elasticsearch and visualize using Kibana4.The 3 JSON keys are NT,XTand YT. The values are typically integers between 100 and 1000 for all the three keys. Some typical values are 543,328 and 753. When I visualize the keys in Kibana4 I get the below warning for each of the above three keys.

This is an analyzed string field.Analyzed string fields are highly unique and can use a lot of memory to visualize

In an attempt to fix the above problem I have used the below shell script to create a mapping for the document type in elastic search that contain these keys.

My elasticsearch index is bits and my document type is nts and I am trying to assign type long for 3 JSON keys in the document of type nts namely NT, XT and YT. 

#!/bin/bash

curl -XPUT 'http://localhost:9200/bits/nts/_mapping' -d '
{
        "events" : {
            "dynamic" : "strict",
            "properties" : {
                "NT" : {
                        type : "long" 
                 },
                "XT" : {
                        type : "long" 
                 },
                "YT"  : {
                        type : "long" 
                }
            }
        },
}'

The above mapping doesn't fix the problem and I am still getting the analyzed string field warning. Can someone point out what could be wrong?

Solution

  • Make sure that your fields actually get indexed as integers (i.e. no quotes around the numbers) by checking individual indexed documents JSON on Discover tab in Kibana.

    You may need to change how your application indexes data. index.mapping.ignore_malformed and index.mapping.coerce setting described here may also be of help.

    Also try going to Settings -> Indices -> and clicking the "Reload field list" button in Kibana since it caches field types.

    And finally, if you're using timestamped index patterns (like [logstash-]YYYY.MM.DD) you may need to rename or delete old indexes where your fields are indexed as strings