_index not searchable/aggregatable

[devoncrouse]

Would someone mind taking a second look at #3999? I feel it may have been closed prematurely.

[rashidkpc]

I had another look at it and tested the behavior. This issue is that as far as elasticsearch tells kibana, aggregating and searching on _index is not allowed as by default as it has no index property. I'd recommend filing an issue on the elasticsearch repository and referencing this issue.

"_index": {
  "full_name": "_index",
  "mapping": {
    "_index": {
      "store": false,
      "enabled": false,
      "fielddata": {}
    }
  }
}

You can work around the issue in elasticsearch by setting your _index field to be indexed. This will require reindexing your data.

PUT /SomeIndex
{
    "mappings": {
        "SomeType": {
            "properties": {
                 "_index": {
                    "type": "string",
                    "index": "not_analyzed"
                }       
            }
        }
    }
}

[clever-trevor]

Hi there, I was trying to do this myself today, using an aggregation to show number of documents by index and hit this problem myself.

When building a visualisation, I can select _type from the field selection box on the left hand pane, but not _index.

Taking it further, if I build a aggregation using a "normal" field and run it directly into Elastic, and then replace the aggregation term with "_index", it works fine.
{ "size": 0, "query": { "filtered": { "query": { "query_string": { "query": "*", "analyze_wildcard": true } }, "filter": { "bool": { "must": [ { "range": { "timestamp": { "gte": 1291972754953, "lte": 1449739154953, "format": "epoch_millis" } } } ], "must_not": [] } } } }, "aggs": { "2": { "terms": { "field": "_index", "size": 5, "order": { "_count": "desc" } } } } }

Results :
{ "took": 80, "timed_out": false, "_shards": { "total": 139, "successful": 139, "failed": 0 }, "hits": { "total": 1744420, "max_score": 0, "hits": [] }, "aggregations": { "2": { "doc_count_error_upper_bound": 0, "sum_other_doc_count": 60806, "buckets": [ { "key": "logstash-metrics-work-management", "doc_count": 855384 }, { "key": "logstash-metrics-continuous-integration", "doc_count": 239372 }, { "key": "logstash-metrics-service-management-change", "doc_count": 215808 }, { "key": "logstash-metrics-primary-metrics-agg", "doc_count": 201370 }, { "key": "logstash-metrics-version-control-commit", "doc_count": 171680 } ] } } }

So if _index were available in the drop-down selection box, then I think this would work - the question is how do we get it in there?

[Bargs]

This has been fixed by #5806