timelion metric cardinality wired behavior

Question

i'm playing timelion, kibana's plugin. most of features works fine on my dataset except one: cardinality

the demo in timelion's blog show

.es(*), .es(metric=cardinality:user)

in my dataset, i have a similar case: logs and city_name, i would like to replace the user with city_name, so here is what i tried:

.es(*), .es(metric=cardinality:geoip.city_name)

but the value in second graph line are all zero, even when i tried:

.es(metric=cardinality:geoip.city_name)

still same result. but when i tried similar field:

.es(metric=cardinality:geoip.ip)

it works well, fields like "latitude", "longitude" also works well, but other string filed such as "region_name","country_name","timezone" all turns out to be 0.

the only difference i can see is the different data type: type with float and ip works well string type can not work

my question is if it's possible to use string field as cardinality.

Answer 1

after a deep look, turns out the field which cardinality calculation is against to should not be analyzed, this is why string filed is failed. simply replace geoip.ip with geoip.ip.raw solved my problem.