Templating doesn't work with some fields in Grafana + ElasticSearch

Grafana Elasticsearch
1

I have an issue while templating on Grafana 4.4.1 with ElasticSearch 5.4.1 as a data source.

My goal is to display on Grafana the CPU/RAM usage of a specific process on several servers. Because I don’t want to manually create a panel for each server, I’m creating a variable template linking to the terms of the server field.

Here is an example of how my data looks:

{
 _index: infra,
 _type: process,
 _source: {
     cpu: an integer,
     server: a string,
     ram: an integer,
     process: a string
 }
}

When I query {"find": "terms", "field": "server"}

Grafana finds none of the servers (when it’s supposed to find the different servers present in the datasource).

The part that I don’t get is that the same query would correctly work with some of the document fields (but not all)… Any idea of what’s going on?

2

The query syntax looks correct. Are you sure the field name is server? What does your mapping look like?

curl -s "localhost:9200/your_index_name-2017.12.21/_mapping?pretty=true"
3

It was indeed because of the mapping.

server is multi-fields, here is its mapping:

"server": {
   "type": "text",
      "fields": {
         "raw": {
            "type": "keyword"
         }
      }
}

And querying {"find": "terms", "field": "server.raw"} works in Grafana!

In fact, this query returns a list of values for a field using term aggregation. I had no idea that a text type can’t be used for aggregations.

1 Like