Hello all,
I curled JSON directly into my ES and when I go to do a visualization using a Count aggregation, - term split, all of the separate fields come out completely equal.
For example, If I want to report on iPhones, iPads, and androids, and I have an uneven amount of all of them..they will still show up completely 33% equal. It does with any term split I use.
When I imported csv through log stash, it showed correctly.