Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

top ten terms has not worked since kibana 3.0.0 #1308

Closed
KlavsKlavsen opened this issue Jun 16, 2014 · 4 comments
Closed

top ten terms has not worked since kibana 3.0.0 #1308

KlavsKlavsen opened this issue Jun 16, 2014 · 4 comments

Comments

@KlavsKlavsen
Copy link

I can't find a bug for it.. so sorry if this is a duplicate (I'm guessing it must be), but when I choose microanalysis on a field called clientip (containing ip's - of type ip), it shows the top-ten in the "micro resultset - ie. the 500" just fine.
When I then choose terms->table (or terms->bar) - and get the resultset - I get a result just fine - but the ip's are "scrambled" - into very similar looking numbers:
Term Count
1398747910 991284
1522026757 480189
1398374058 241057
1398609708 225808
1352797334 197073
1463591740 153558
1355959051 100584
1463449848 99799
1398358320 89000
1398560262 81761
Missing field 22
Other values 1031701

@rashidkpc
Copy link
Contributor

This is an effect of Elasticsearch. Terms facets run against the field data structure which contains the values as they are indexed by Elasticsearch, IPs are indexed as longs. If you need IP types as strings your best best bet right now is to store them as strings in another field. We are working on a better way to handle this in an upcoming version of Kibana

@KlavsKlavsen
Copy link
Author

is kibana 3.1 ready for beta testers ? (and is that where you've tried to handle it better?) :)

@KlavsKlavsen
Copy link
Author

could I do what is suggested here: elastic/elasticsearch#3321 (comment)
a multi_field mapping:
curl -XPUT http://localhost:9200/foo/bar/_mapping -d '{ "bar": { "properties": { "clientip": { "type": "multi_field", "fields": { "clientip": { "type": "ip" }, "clientip_facet": { "type": "string", "index": "not_analyzed" } } } } } }'

be one way to make it work? or perhaps call it clientip.raw (logstash uses that naming for extra - not_analyzed originals of fields) - but that would require kibana to pull in that extra field for each "hit" from the terms facet, if that's possible?

@yinchuan
Copy link

hello guys,dose kibana 3.1.0 support multi_field mapping mentioned by @KlavsKlavsen ?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants