text
fields, and fielddata
is disabled on text
fields by default, so you can't use aggregations on them.fielddata
for text
fields (which is liable to chew through memory), or re-index message content in a separate keyword
field.text
fields, and by its very nature should ignore common words (which the above won't do, so you're likely to get a lot of stop words). The caveat being it does require a lot of time and memory if you can't filter down the result set first, but it looks like the sampler aggregations might be good for that._source
to be enabled though (it's disabled in XFES indexes), so you'd still need to create a separate index for this with it enabled.\XFES\Service\Optimizer::getBaseMapping()
to flip ['_source']['enabled']
. I don't think it should cause problems, but the resulting index size will likely be a fair bit larger. Unfortunately you'd still be looking at rebuilding the entire index afterwards, which you may (understandably) be looking to avoid.We use essential cookies to make this site work, and optional cookies to enhance your experience.