Menu
When adding a filter in kibana all string fields have a entry and .keyword entry. What is the difference?
588
keyword field takes the same input and keeps as one large string, meaning it can be aggregated on, and you can use wildcard searches on it. Aggregatable means you can use it in aggregations in elasticsearch, which resembles a sql group by if you are familiar with that.
The keyword family includes the following field types: keyword , which is used for structured content such as IDs, email addresses, hostnames, status codes, zip codes, or tags. constant_keyword for keyword fields that always contain the same value. wildcard for unstructured machine-generated content.
Numeric fields support Bytes, Color, Duration, Histogram, Number, Percentage, String, and Url formatters. The Bytes, Number, and Percentage formatters enable you to choose the display formats of numbers in the field using the Elastic numeral pattern syntax that Kibana maintains.
The crucial difference between them is that Elasticsearch will analyze the Text before it's stored into the Inverted Index while it won't analyze Keyword type. Analyzed or not analyzed will affect how it will behave when getting queried.
From elasticsearch 5 there is no string field type, instead there is two types:
Keyword - use it for filter, aggregation and sort.
Text - use it for search text.
When you index documents with string field, for example name, elasticsearch mapping the field to text field for search and to keyword for filter.
Kibana use the field for filter and aggregation, therefore using the keyword.
Look at elasticsearch documentation
186
In fact, it is not an Kibana issue, it's an ElasticSearch issue which make full-text and keyword search both conformable. The filed.keyword is for keyword search and aggregation, while the original field is used for full-text search.
There is an official blog specialized for this: https://www.elastic.co/cn/blog/strings-are-dead-long-live-strings
There is also a post on the official discuss board, here is the link for your reference: https://discuss.elastic.co/t/why-am-i-getting-keyword-for-my-feilds-in-index-pattern/137983
42
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
