Elastic Search analyzing fields and Kibana Graphs Legends

Question

I'm using elasticsearch 1.5.2 and Kibana 4.0.3.

I'm having a problem with the analyzers, using the default one the legends in the kibana graphs split the field by &, / and -. Which is the default behavior. I've tried setting the fields to not_analyzed and then the kibana legends display fine and the grouping in the graphs works are I want, by field. The problem is that the wildcard doesn't work with the search, to search a field you need to use the exact value.

I haven't been able to find an analyzer or a tokenizer that would preserver the field as it is.

Any ideas on how could I use the not_analyzed but still have the search as when it's analyzed?

Thanks, Isaac

Answer 1

You need to use a multi-field (https://www.elastic.co/guide/en/elasticsearch/reference/current/_multi_fields.html) to achieve what you want.

For example:

"title": {
    "type": "string",
    "fields": {
        "raw":   { "type": "string", "index": "not_analyzed" }
    }
}

You'd then use title:whatever to search and title.raw in the kibana panel to get the correct legend behavior.