Keyword-Based Search in Kibana

In the Elasticsearch and Kibana ecosystem, keyword-based search is one of the core capabilities for handling text data. Unlike the default text type, which performs tokenization, the keyword type treats each field as a single, indivisible string unit without splitting it into tokens. This characteristic makes it indispensable in scenarios requiring exact matching, multi-value sorting, or serving as a unique identifier. Understanding this mechanism is crucial for building efficient data query strategies.
Before diving into specific applications, we must clarify the fundamental difference between the keyword type and the text type. The default text type splits input strings into multiple tokens (words) and builds an inverted index to support natural language search and fuzzy matching; in contrast, the keyword type preserves the integrity of the original string without performing any tokenization operations.

This means:

Exact Matching: If you need to find a phrase or sentence that is completely consistent, keyword is the only choice. For example, searching for the term "Machine Learning" might only match documents containing the word in a text field, whereas it can precisely hit all documents where the value in the keyword field is exactly "Machine Learning".
Multi-value Sorting: When a document contains multiple instances of the same keyword (e.g., in a tagging system), the keyword type allows independent sorting for each instance. The text type, however, merges tokens after splitting and cannot distinguish the order of these duplicate items.
Unique Identifiers: Fields requiring strict one-to-one mapping, such as IDs or status codes, should always use the keyword type.

Practical Application Scenarios

To better understand how to apply keyword-based search, let us refer to several typical production scenarios.

1. Multi-tag Classification System

In e-commerce or content management systems, users may assign multiple tags to a single product, such as "Red", "Summer", and "Promotion". If these tags are stored in a text field, tokenization might lose the information that "Red" is a complete concept, leading to confusion when sorting by color. By mapping this field as the keyword type, we can:

Independently sort each tag instance (e.g., display red products first).
Support multi-value aggregation queries (Multi-get), making it easy to count the number of products per color.

2. Exact Phrase Retrieval

Assume we have a log system containing complete error messages. If users want to input "Connection Timeout" and directly find all logs containing that exact sentence, using full-text search with the text type is feasible but less efficient and may match irrelevant content containing only parts of the word. By enabling the keyword type, Elasticsearch builds an inverted index based on string prefixes, supporting efficient exact phrase matching and prefix searches.

3. Status Code and Enum Value Management

In user management systems, user roles (e.g., "Administrator", "Guest") or order statuses (e.g., "Pending Payment", "Shipped") typically have discrete and limited values. Defining these fields as the keyword type ensures:

The value of this field within each document is unique at the indexing level.
Even if a document has multiple identical role tags, sorting and aggregation analysis are performed correctly.

Configuration and Operation Practices in Kibana

When operating with keyword-based search in the Kibana Discover interface, keep the following key settings in mind:

Field Mapping Verification: First, confirm that you have set the relevant fields to the keyword type in your Elasticsearch index definition. If a field is of the text type, Kibana will default to ignoring its exact matching functionality unless specific filter rules are manually configured.
Use of Aggregation Views: In the right panel of the Kibana Discover page, you can drag keyword fields into the "Aggregations" area. Since the keyword type supports multi-values, it displays a count for each unique value here, which is ideal for analyzing tag distributions or status statistics.
Sorting Logic: When using keyword-based search, pay close attention to the sorting direction. By default, Kibana sorts keyword fields in ascending alphabetical order. If you need to sort according to business logic (e.g., by timestamp or numeric value), ensure you explicitly specify the sorting field and direction in your query statement.

Performance Optimization Suggestions

Although the keyword type provides powerful exact search capabilities, its indexing method differs from that of the text type, so performance factors should also be considered during design:

Avoid Over-tokenization: Since keyword does not perform tokenization, if a string contains a large number of special characters or spaces, it may lead to an excessive number of index terms, increasing storage consumption.
Prefix Matching Overhead: Although keyword supports prefix searches (e.g., finding all products starting with "Apple"), its underlying implementation is based on string prefix inverted indexes. Compared to the token-based prefix search of the text type, it may be slightly slower in extreme cases. However, in practical applications, this difference is usually negligible.
Composite Query Strategy: For fields that need to support both full-text retrieval and exact matching, it is recommended to create two copies in the Elasticsearch index: one using the text type for natural language search, and another using the keyword type for exact filtering and sorting.

By reasonably utilizing keyword-based search mechanisms, you can significantly improve the accuracy and flexibility of data queries, especially when dealing with complex requirements such as structured tagging, status management, and multi-value sorting.