kibana error in displaying some data

Question

Im indexing from MongoDB 2.4.9 to Elasticsearch 1.1.1 using the River Plugin. And of course, I'm using Kibana3

The documents in the MongoDB that I have contain a cidr. The cidr is in the format:

"cidr" : "0.0.0.0/00"

I have a table and a term panels in my kibana dashboard.

The Table panel shows the part 0.0.0.0/

and the term panel shows the part 00

I need both panels to show the WHOLE cidr value! Like this: 0.0.0.0/00

Does anyone have any idea why these two panels are behaving this way?

Thank you

Answer 1

Elasticsearch is processing the input, and splitting on the "/". logstash should be creating a "raw" version of the field. Try referencing "cidr.raw" in kibana.

If you're not using logstash, you'll need to update the elasticsearch mapping to either set the field to not_analyzed or to add the ".raw" field yourself.

The reference for using not_analyzed is here. Grab the current mapping, edit it, and post it back.

To add ".raw", check out the logstash default template, which shows you the magic to make a multi_field with ".raw".