The field should be a normal text field, which is analyzed, and not a
keyword field, which is not. You can define further analysis if you want,
but the standard analyzer should be good for most scenarios.
After that, you simply run a terms aggregation over the field, but the
field needs to have fielddata enabled:
https://www.elastic.co/guide/en/elasticsearch/reference/current/fielddata.html
I do not use kibana or logstash, so I do not know how those systems are
configured.