Terms Panel is strippling Field contents with space

[galindro]

If you put a Field where it content has space between two words (like Credential Validation), Terms Panel will strip it into two words, displaying a wrong information into graph.

[bobrik]

Here we go again: #364.

[galindro]

Sorry, but the mapping of that field is String. Its correct, because it is a string. To what kind of type I need to change the field for the search ignore spaces?

[bobrik]

        "string_field" : {
          "type" : "string",
          "index" : "not_analyzed"
        }

notice not_analyzed

[galindro]

Ok. I want to change my old indexes to this new one, but I've no success:

curl -XPUT 'http://localhost:9200/logstash-2013.10.25/logs/_mapping' -d '{"logs":{"properties":{"@timestamp":{"type":"date","format":"dateOptionalTime"},"@Version":{"type":"string"},"Category":{"type":"long"},"CategoryString":{"type":"string","index":"not_analyzed"},"ComputerName":{"type":"string"},"Data":{"type":"string"},"EventCode":{"type":"long"},"EventIdentifier":{"type":"long"},"EventType":{"type":"long"},"InsertionStrings":{"type":"string"},"Logfile":{"type":"string"},"RecordNumber":{"type":"long"},"SourceName":{"type":"string"},"TimeGenerated":{"type":"string"},"TimeWritten":{"type":"string"},"Type":{"type":"string"},"User":{"type":"string"},"host":{"type":"string"},"message":{"type":"string"},"path":{"type":"string"},"type":{"type":"string"}}}}'
{"error":"MergeMappingException[Merge failed with failures {[mapper [CategoryString] has different index values, mapper [CategoryString] has different tokenize values, mapper [CategoryString] has different index_analyzer]}]","status":400}

[rashidkpc]

You can not change the analyzer of an existing field, you must reindex.

[galindro]

hmm ok.

I'll try with this procedure:

http://www.elasticsearch.org/blog/changing-mapping-with-zero-downtime/

[abtpst]

this does not seem to be working for fields that have an array/list type. how should i specify the analyzer for such fields?

http://stackoverflow.com/questions/35137022/elasticsearch-es-index-changes-the-mapping-when-message-is-pushed

please advise