Edit mappings within Kibana

[DigiAngel]

Topic says it....it would be nice to have full mapping capabilities within Kibana. For example, IP address is missing. Thank you.

[Bargs]

Sorry, I'm not sure what you're referring to. Kibana supports IP fields. What part of Kibana are you talking about specifically?

[DigiAngel]

Sorry..should have explained better. Per Kibana -> Settings -> Indices:

This page lists every field in the bleh-* index and the field's associated core type as recorded by Elasticsearch. While this list allows you to view the core type of each field, changing field types must be done using Elasticsearch's Mapping API.

Managing mappings via curl/Sense is challenging. For example, I have a field I just realized is "analyzed":

Careful! The field selected contains analyzed strings. Analyzed strings are highly unique and can use a lot of memory to visualize. Values such as foo-bar will be broken into foo and bar. See Mapping Types for more information on setting this field as not_analyzed.

It would be SO much easier to go to Kibana -> Settings -> Indices, find the field, uncheck analyzed, update. I guess I'm looking to Kibana to integrate Mapping management. Unless there's a plugin I'm missing. Thank you.

[Bargs]

Ah, yeah I'm with you, that would be awesome. The difficulty is that for almost any mapping change, you're going to have to re-index your data. Which is something we could handle now that ES has a reindex API, but it makes things more complex. I do think we'll add this some day because it would be so useful but probably not in the near future.

[DigiAngel]

Awesome...thank you.

[markwalkom]

This would make sense for templates as a first step.

[jakommo]

Linking #8110 as it's probably related

[altmind]

I see that kibana now supports VIEWING mapping in index management at /app/kibana#/management/elasticsearch/index_management/home.

It felt so natural to focus the field, change the data type and hit "save", but there is no "save" for this screen :(

it feels we are almost there, dunno why need for reindex prevents us from changing the mapping in kibana

[jakommo]

It felt so natural to focus the field, change the data type and hit "save", but there is no "save" for this screen

You can not change the mapping for an existing field in Elasticsearch (only add new fields) and thus you can't do this in Kibana.
On a high level, the reason for this is that for each field and inverted index is built and if you would be able to change the mapping, that inverted index would need to be "rebuilt" (which is basically what you are doing with a reindex).

[altmind]

the reason for this is that for each field and inverted index is built and if you would be able to change the mapping, that inverted index would need to be "rebuilt"

it would not be that bad if ES reindex allowed to reindex to the same index name. right now its not fire-and-forget, you need to wait for reindex to complete to swap the indices. but yes, thats out of kibana scope.

[yaronp68]

closing as this is really a feature request for ReIndexing support in GUI