Anyone? please? On Saturday, August 2, 2014 1:26:51 AM UTC+3, Eitan Vesely wrote: > > Hi all, > > i have a field named "msg" in my index that holds an error message string. > when trying to count the top N errors i set the field to msg.raw yet i > still see that the terms are all the words comprising the strings rather > than the whole string as i would expect. > (i did not set this field to be "not_analyzed and if i understand > correctly logstash does that and puts it under the "raw" tag...) > this is my input, configuration and output > [image: image] > <https://cloud.githubusercontent.com/assets/8070047/3785753/b6d09b46-19c9-11e4-8eba-5036e867b265.png> > > [image: image] > <https://cloud.githubusercontent.com/assets/8070047/3785744/7b0566f0-19c9-11e4-9227-01efff20a812.png> > > [image: image] > <https://cloud.githubusercontent.com/assets/8070047/3785736/62d79f1c-19c9-11e4-93cf-f5dd89ffc8e7.png> >
-- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/9c869767-8119-45b0-a3b8-58f5389c01a7%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
