What's the difference between the 'field' and 'field.keyword' fields in Kibana?

Question

When adding a filter in kibana all string fields have a entry and .keyword entry. What is the difference?

Semitone

Answer 1

From elasticsearch 5 there is no string field type, instead there is two types:

Keyword - use it for filter, aggregation and sort.

Text - use it for search text.

When you index documents with string field, for example name, elasticsearch mapping the field to text field for search and to keyword for filter.

Kibana use the field for filter and aggregation, therefore using the keyword.

Look at elasticsearch documentation

Expletive

Thanks for explanation, however are always both variants automatically created by Elastic? Or bascially how come we always have these two variants for String fields? – Twoedged

Answer 2

In fact, it is not an Kibana issue, it's an ElasticSearch issue which make full-text and keyword search both conformable. The field.keyword is for keyword search and aggregation, while the original field is used for full-text search.

There is an official blog specialized for this: https://www.elastic.co/cn/blog/strings-are-dead-long-live-strings

There is also a post on the official discuss board, here is the link for your reference: https://discuss.elastic.co/t/why-am-i-getting-keyword-for-my-feilds-in-index-pattern/137983

Endowment

Okay, so does Elastic make both options available by default? Isn't it costly for the server to have both of them by default? Or they are not generated both be default? – Twoedged

Answer 3

to add on to this in case it helps someone is that the .keyword field can be used to create scripted fields on the index if you already have a matching keyword field. Do not need to go through the trouble of switching fielddata to true and reindexing

Chivy