Kibana data tables visualizations seperate fields on punctuation. How can I combine them?

[Ambrose]

So I figured it out.

As was pointed out, it was necessary to change the fields that I wanted to visualize as "not_analyzed" in the mappings. I figured out how to do that by following this guide:

Update mapping API | Elasticsearch Guide [8.11] | Elastic

While this had the effect of changing all of the fields in my index to "not_analyzed" it unfortunately made it such that Kibana could no longer see the data anymore. After Pointing to that index, Kibana knew that there was data there but couldn't see it in either the visualize or the discover tab.

After almost giving up on this entire ELK project in general, I found this topic:

Confused about how to use .raw fields and not analyze string fields

I apologize if this is too newbie a question but I am struggling with setting up a terms visualization in Kibana 4 because the string field with the terms is analysed. I am using logstash with the elasticsearch output to populate my index. In my searching around the web, my understanding is that the default logstash template for ES creates a multi-field for each string field where one of the fields is .raw. So somewhere in my index is the ability to use a not_analyzed version of my field. I thi…

Which points out that the .raw fields exist as long as the index starts with "logstash-". I was renaming my index something else that does not have "logstash-" in it and it wasn't matching properly with some default template I have somewhere.

Once I renamed all my indexes to start with "logstash-", Kibana started seeing the .raw fields and I was able to do my visualizations and discoveries correctly.