My ELK is logstash 2.1.3, elasticsearch 2.2.1,kibana 4.4.2.
I transfer redhat linux rsyslog to ELK, some of the linux hostname include special character,like "wks-ems01" , the "host" field storing hostname is the "string" type with "analyzed,indexed,the default standard Analyzer" .
it display the correct name in elasticsearch:
but when I create pie chart in kibana, kibana will divide the hostname to two values:"wks" and "ems01" ( marked in red rectangle in the following snapshot).
How can it display the correct full hostname? thanks.