In Pie chart, terms of 2 words are considered as 2 different labels

[pvledoux]

Hi,

I'm testing Kibana to do some analytics and I saw that terms of 2 words in Pie chart are displayed as 2 different label:

"Internet Explorer" as Internet and Explorer

"Mac Os x" as "Mac" "OS" "x"

Is there a way to keep those terms in one words?

Cheers,

[electrical]

You will need to set the field type in Elasticsearch to non_analyzed.
This can be done in templates ( see http://elasticsearch.org/guide/reference/api/admin-indices-templates/ )

@rashidkpc please correct me if i'm wrong :-)

[pvledoux]

Well, I tried with the following mappings, but no luck:

{
    "trackedData": {
        "properties": {
            "user.agent.vendor": {
                "type":"string",
                "properties": {
                    "index": "not_analysed"
                }
            },
            "user.agent.platform": {
                "type":"string",
                "properties": {
                    "index": "not_analysed"
                }
            }
        }
    }
}

I also tried to declare user and agent as nested, but in that case, the pie chart is totally empty.

[dadoonet]

What happens if you set it like this:

{
    "trackedData": {
        "properties": {
            "user.agent.vendor": {
                "type":"string",
                "index": "not_analyzed"
            },
            "user.agent.platform": {
                "type":"string",
                "index": "not_analyzed"
            }
        }
    }
}

[rashidkpc]

Also note that you'll need to reindex your data after applying a mapping. Closing as notabug

[pvledoux]

@dadoonet Merci David! Thanks @rashidkpc!

[SYNchroACK]

Hi guys,

I still had the same problem with Pie Dashboards. I tried a lot of possibilities and nothing. Please, can you check this following configuration:

------------------- LogStash configuration -------------------

input {
    tcp {
        port => 4000
        type => syslog
    }
}
filter {
    kv {
        field_split => ","
        value_split => "="
    }
}
output {
    stdout { debug => true debug_format => "json"}
    elasticsearch { embedded => true index => "mysystem" }
}

------------------- Mapping ElasticSearch -------------------

curl -XPUT http://localhost:9200/mysystem -d '{
    "settings" : {
        "number_of_shards" : 1
    },
    "mappings" : {
        "mysystem" : {
            "properties" : {
                "@fields" : {
                    "type" : "object",
                    "dynamic": true,
                    "path": "full",
                    "properties" : {
                        "as_name" : {"type" : "string", "index" : "not_analyzed"},
                        "asn" : {"type" : "integer"},
                        "ip" :{"type" : "string"}
                    }
                }
            }
        }
    }
}
'

------------------- Events to Insert -------------------

asn="1930",as_name="Portugal Network",ip="193.136.110.110"
asn="1930",as_name="Portugal Network",ip="193.136.120.120"
asn="1930",as_name="Other",ip="193.136.100.100"

Thank you,
Cheers