Kibana using ".raw" field, when I'm telling it not to

[KhaoticMind]

Hey,
I'm using Kibana to visualize some OSSEC logs.
The problem I'm facing is that, when I setup a terms panel, and set the field to be "host" (for example), it is using "host.raw" in the query, as seen below.

  "facets": {
    "terms": {
      "terms": {
        "field": "host.raw",
        "size": 10,
        "order": "count",
        "exclude": []
      },
      "facet_filter": {
        "fquery": {
          "query": {

I'm using ES multifields to create the rawfield as bellow

"host" : {
         "norms" : {
              "enabled" : false
          },   
          "type" : "string",
          "fields" : {
           "raw" : {
                 "index" : "not_analyzed",
                  "ignore_above" : 256,
                   "type" : "string"
              }
         }
}

The problem here is that I've removed the multifield on some of my indexes and so the result from host.raw is completely off when compared to just host.

Any idea what might be wrong?

[batwad]

I've noticed this behaviour myself and found it a bit weird. The terms panel looks for a "raw" field automatically it seems:
https://github.com/elasticsearch/kibana/blob/master/src/app/panels/terms/module.js#L155

I've removed the corresponding code from my local kibana installation and it uses the field I specify, leaving me in full control.

I can understand the reasoning behind doing this for the terms panel, but I would still rather be in control and be able to tell it to use the raw field if I want it to.

[rashidkpc]

We've abandoned this behavior in Kibana 4, you're welcome to use .raw if you'd like, but we don't force it on you anymore.

[jasonrhaas]

@rashidkpc is there a way to allow kibana4 to recognize the .raw fields that Logstash generates?

[blevine]

Same question as @jasonrhaas . I want to be able to use the raw fields as terms in an aggregation, but none of the *.raw fields I'm generating appear in the dropdown. I've confirmed that the .raw fields are actually generated and indexed by using them successfully in a query.