breaking field value on hypen
up vote
0
down vote
favorite
I have following sample docs in Elasticsearch
[
{
"_index": "beatbox-2018.11.19",
"_source": {
"connection": "10",
"user": "op-dashboard",
"key": "monolith_connection_sniffer"
}
},
{
"_index": "beatbox-2018.11.19",
"_source": {
"connection": "10",
"user": "op-dashboard",
"key": "monolith_connection_sniffer"
}
}
]
When I query on user, I got expected result.
curl -X GET
'http://127.0.0.1:9200/beatbox-2018.11.19/_search?q=user:op-dashboard'
In Grafana:
I was trying to add some query with Variable for user field.
{ "find": "terms", "field": "user" }
But I got tokenised values of user field.
`op`, `dashboard`
In background, following payload is sending for query
{
"size": 0,
"query": {
"bool": {
"filter": [
{
"query_string": {
"analyze_wildcard": true,
"query": "*"
}
}
]
}
},
"aggs": {
"1": {
"terms": {
"field": "user",
"size": 500,
"order": {
"_term": "asc"
}
}
}
}
}
Query returns tokenised result. How can I stop it?
I have already tried with following template
{
"index_patterns": [
"beatbox*"
],
"mappings": {
"doc":
"properties": {
"user": {
"type": "text",
"fielddata": true,
"analyzer":"whitespace",
"search_analyzer": "whitespace"
}
}
}
}
}
And also with analyzer
{
"index": {
"analysis": {
"default": {
"analyzer": {
"analyzer_keyword": {
"tokenizer": "whitespace"
}
}
}
}
}
}
Mapping for index:
{
"beatbox-2018.11.19":{
"mappings":{
"doc":{
"_all":{
"enabled":false
},
"numeric_detection":true,
"properties":{
"connection":{
"type":"long"
},
"key":{
"type":"text",
"norms":false,
"index_options":"freqs"
},
"user":{
"type":"text",
"fielddata":true
}
}
}
}
}
}
Any help?
elasticsearch grafana elasticsearch-6 grafana-variable asked Nov 19 at 6:47
aerokite
5,99943366
add a comment |
up vote
0
down vote
favorite
I have following sample docs in Elasticsearch
[
{
"_index": "beatbox-2018.11.19",
"_source": {
"connection": "10",
"user": "op-dashboard",
"key": "monolith_connection_sniffer"
}
},
{
"_index": "beatbox-2018.11.19",
"_source": {
"connection": "10",
"user": "op-dashboard",
"key": "monolith_connection_sniffer"
}
}
]
When I query on user, I got expected result.
curl -X GET
'http://127.0.0.1:9200/beatbox-2018.11.19/_search?q=user:op-dashboard'
In Grafana:
I was trying to add some query with Variable for user field.
{ "find": "terms", "field": "user" }
But I got tokenised values of user field.
`op`, `dashboard`
In background, following payload is sending for query
{
"size": 0,
"query": {
"bool": {
"filter": [
{
"query_string": {
"analyze_wildcard": true,
"query": "*"
}
}
]
}
},
"aggs": {
"1": {
"terms": {
"field": "user",
"size": 500,
"order": {
"_term": "asc"
}
}
}
}
}
Query returns tokenised result. How can I stop it?
I have already tried with following template
{
"index_patterns": [
"beatbox*"
],
"mappings": {
"doc":
"properties": {
"user": {
"type": "text",
"fielddata": true,
"analyzer":"whitespace",
"search_analyzer": "whitespace"
}
}
}
}
}
And also with analyzer
{
"index": {
"analysis": {
"default": {
"analyzer": {
"analyzer_keyword": {
"tokenizer": "whitespace"
}
}
}
}
}
}
Mapping for index:
{
"beatbox-2018.11.19":{
"mappings":{
"doc":{
"_all":{
"enabled":false
},
"numeric_detection":true,
"properties":{
"connection":{
"type":"long"
},
"key":{
"type":"text",
"norms":false,
"index_options":"freqs"
},
"user":{
"type":"text",
"fielddata":true
}
}
}
}
}
}
Any help?
elasticsearch grafana elasticsearch-6 grafana-variable asked Nov 19 at 6:47
aerokite
5,99943366
add a comment |
up vote
0
down vote
favorite
up vote
0
down vote
favorite
I have following sample docs in Elasticsearch
[
{
"_index": "beatbox-2018.11.19",
"_source": {
"connection": "10",
"user": "op-dashboard",
"key": "monolith_connection_sniffer"
}
},
{
"_index": "beatbox-2018.11.19",
"_source": {
"connection": "10",
"user": "op-dashboard",
"key": "monolith_connection_sniffer"
}
}
]
When I query on user, I got expected result.
curl -X GET
'http://127.0.0.1:9200/beatbox-2018.11.19/_search?q=user:op-dashboard'
In Grafana:
I was trying to add some query with Variable for user field.
{ "find": "terms", "field": "user" }
But I got tokenised values of user field.
`op`, `dashboard`
In background, following payload is sending for query
{
"size": 0,
"query": {
"bool": {
"filter": [
{
"query_string": {
"analyze_wildcard": true,
"query": "*"
}
}
]
}
},
"aggs": {
"1": {
"terms": {
"field": "user",
"size": 500,
"order": {
"_term": "asc"
}
}
}
}
}
Query returns tokenised result. How can I stop it?
I have already tried with following template
{
"index_patterns": [
"beatbox*"
],
"mappings": {
"doc":
"properties": {
"user": {
"type": "text",
"fielddata": true,
"analyzer":"whitespace",
"search_analyzer": "whitespace"
}
}
}
}
}
And also with analyzer
{
"index": {
"analysis": {
"default": {
"analyzer": {
"analyzer_keyword": {
"tokenizer": "whitespace"
}
}
}
}
}
}
Mapping for index:
{
"beatbox-2018.11.19":{
"mappings":{
"doc":{
"_all":{
"enabled":false
},
"numeric_detection":true,
"properties":{
"connection":{
"type":"long"
},
"key":{
"type":"text",
"norms":false,
"index_options":"freqs"
},
"user":{
"type":"text",
"fielddata":true
}
}
}
}
}
}
Any help?
elasticsearch grafana elasticsearch-6 grafana-variable asked Nov 19 at 6:47
aerokite
5,99943366
I have following sample docs in Elasticsearch
[
{
"_index": "beatbox-2018.11.19",
"_source": {
"connection": "10",
"user": "op-dashboard",
"key": "monolith_connection_sniffer"
}
},
{
"_index": "beatbox-2018.11.19",
"_source": {
"connection": "10",
"user": "op-dashboard",
"key": "monolith_connection_sniffer"
}
}
]
When I query on user, I got expected result.
curl -X GET
'http://127.0.0.1:9200/beatbox-2018.11.19/_search?q=user:op-dashboard'
In Grafana:
I was trying to add some query with Variable for user field.
{ "find": "terms", "field": "user" }
But I got tokenised values of user field.
`op`, `dashboard`
In background, following payload is sending for query
{
"size": 0,
"query": {
"bool": {
"filter": [
{
"query_string": {
"analyze_wildcard": true,
"query": "*"
}
}
]
}
},
"aggs": {
"1": {
"terms": {
"field": "user",
"size": 500,
"order": {
"_term": "asc"
}
}
}
}
}
Query returns tokenised result. How can I stop it?
I have already tried with following template
{
"index_patterns": [
"beatbox*"
],
"mappings": {
"doc":
"properties": {
"user": {
"type": "text",
"fielddata": true,
"analyzer":"whitespace",
"search_analyzer": "whitespace"
}
}
}
}
}
And also with analyzer
{
"index": {
"analysis": {
"default": {
"analyzer": {
"analyzer_keyword": {
"tokenizer": "whitespace"
}
}
}
}
}
}
Mapping for index:
{
"beatbox-2018.11.19":{
"mappings":{
"doc":{
"_all":{
"enabled":false
},
"numeric_detection":true,
"properties":{
"connection":{
"type":"long"
},
"key":{
"type":"text",
"norms":false,
"index_options":"freqs"
},
"user":{
"type":"text",
"fielddata":true
}
}
}
}
}
}
Any help?
elasticsearch grafana elasticsearch-6 grafana-variable elasticsearch grafana elasticsearch-6 grafana-variable asked Nov 19 at 6:47
aerokite
5,99943366
asked Nov 19 at 6:47
aerokite
5,99943366
edited Nov 19 at 9:28
asked Nov 19 at 6:47
aerokite
5,99943366
asked Nov 19 at 6:47
aerokite
5,99943366
asked Nov 19 at 6:47
aerokite
5,99943366
5,99943366
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
up vote
1
down vote
accepted
You should you Keyword Datatype of elasticsearch instead of text datatype in user fields as you are aggregating it.
answered Nov 19 at 9:49
safwan
712
Thank you. It works
– aerokite
Nov 19 at 10:46
add a comment |
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
1
down vote
accepted
You should you Keyword Datatype of elasticsearch instead of text datatype in user fields as you are aggregating it.
answered Nov 19 at 9:49
safwan
712
Thank you. It works
– aerokite
Nov 19 at 10:46
add a comment |
up vote
1
down vote
accepted
You should you Keyword Datatype of elasticsearch instead of text datatype in user fields as you are aggregating it.
answered Nov 19 at 9:49
safwan
712
Thank you. It works
– aerokite
Nov 19 at 10:46
add a comment |
up vote
1
down vote
accepted
up vote
1
down vote
accepted
You should you Keyword Datatype of elasticsearch instead of text datatype in user fields as you are aggregating it.
answered Nov 19 at 9:49
safwan
712
You should you Keyword Datatype of elasticsearch instead of text datatype in user fields as you are aggregating it.
answered Nov 19 at 9:49
safwan
712
answered Nov 19 at 9:49
safwan
712
answered Nov 19 at 9:49
safwan
712
answered Nov 19 at 9:49
safwan
712
712
Thank you. It works
– aerokite
Nov 19 at 10:46
add a comment |
Thank you. It works
– aerokite
Nov 19 at 10:46
Thank you. It works
– aerokite
Nov 19 at 10:46
Thank you. It works
– aerokite
Nov 19 at 10:46
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53369593%2fbreaking-field-value-on-hypen%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
