Templating doesn't work with some fields in Grafana + ElasticSearch

I have an issue while templating on Grafana 4.4.1 with ElasticSearch 5.4.1 as a data source.

My goal is to display on Grafana the CPU/RAM usage of a specific process on several servers. Because I don’t want to manually create a panel for each server, I’m creating a variable template linking to the terms of the server field.

Here is an example of how my data looks:

 _index: infra,
 _type: process,
 _source: {
     cpu: an integer,
     server: a string,
     ram: an integer,
     process: a string

When I query {"find": "terms", "field": "server"}

Grafana finds none of the servers (when it’s supposed to find the different servers present in the datasource).

The part that I don’t get is that the same query would correctly work with some of the document fields (but not all)… Any idea of what’s going on?

The query syntax looks correct. Are you sure the field name is server? What does your mapping look like?

curl -s "localhost:9200/your_index_name-2017.12.21/_mapping?pretty=true"

It was indeed because of the mapping.

server is multi-fields, here is its mapping:

"server": {
   "type": "text",
      "fields": {
         "raw": {
            "type": "keyword"

And querying {"find": "terms", "field": "server.raw"} works in Grafana!

In fact, this query returns a list of values for a field using term aggregation. I had no idea that a text type can’t be used for aggregations.

1 Like