PIE chart splits the values before making the chart

[nielsbasjes]

If the values you want to show in a pie chart contain spaces then those values are split before they are placed into the pie chart. This makes those pie charts effectively useless in those situations.

As an example: If you put the user agent string from a weblog into a PIE chart then you get the screenshot below.

If I filter in one specific useragent
"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
I get this:

[nielsbasjes]

Note: I'm using git commit id c03373c

[caspergasper]

Have you got this field set to not_analyzed in elasticsearch?

[nielsbasjes]

I used a very basic logstash config to upload this data in to elasticsearch.
So I assume I have not set this.

[rashidkpc]

Elasticsearch breaks fields into term, the pie chart uses a terms facet to get them back out. If you don't want a field broken into terms you need to set it as 'not_analyzed' using a template:

Here's a simple explanation:
https://github.com/logstash/logstash/wiki/Elasticsearch----Using-index-templates-&-dynamic-mappings

[wdaley]

I suggest this is a bug/necessary feature. If the itemization on the page can display the entire "user_agent" string, then the UI should support aggregating on it. Yes, I understand that elasticsearch does not work that way, but kibana, as the UI, should. Perhaps there should be an easy way to configure "not_analyzed" fields via kibana. The user-agent search is a really common use case and should not require a user to reconfigure elasticsearch by hand to support it.

[damonsmith]

The wiki appears to have disappeared, but I found that if I selected the type with the .raw extension in Kibana then I get the pie graph grouped correctly rather than splitting on spaces. I also don't know if that's a new thing or not but it worked for me.