# Kibana is dividing the urls **URL:** \ **Category:** Kibana\ **Created:** [October 27, 2016, 12:05pm UTC](https://discuss.elastic.co/t/kibana-is-dividing-the-urls/64139 "2016-10-27T12:05:29Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Leooel](https://avatars.discourse-cdn.com/v4/letter/l/e5b9ba/32.png) [@Leooel](https://discuss.elastic.co/u/Leooel)\ **Post date:** [October 27, 2016, 12:05pm UTC](https://discuss.elastic.co/t/kibana-is-dividing-the-urls/64139/1 "2016-10-27T12:05:29Z")
Recently I created a grok to parse logs of Squid3, and all work normally to send all the data to elasticsearch. I can see everything normally on discover part, but when I create a graphic visualization, to analize the urls requisitions, Kiana is dividing the urls. EX: "443", "wp", "www86", "rf", "ss", and more things like that ![](https://us1.discourse-cdn.com/elastic/original/2X/1/18208b59db6b0bcca2e1ec0924f4fd050ec5c43c.PNG) ![](https://us1.discourse-cdn.com/elastic/original/2X/e/e6e2d6f5d7e550f31957d311d5a7dc3caacd1597.PNG) ---
**Author:** ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)\ **Post date:** [October 27, 2016, 4:43pm UTC](https://discuss.elastic.co/t/kibana-is-dividing-the-urls/64139/2 "2016-10-27T16:43:47Z")
Hi Leonardo, You're using an analyzed field in your visualization. Strings like your URL that are sent to the standard analyzer are separated into terms by punctuation marks like the `.`s in your URLs. Depending on how you are getting your logs into Elasticsearch you could have both an analyzed and not analyzed (or raw) field, and in this case you would want that field. Discover tab in Kibana doesn't show these fields, but they should be available in Visualizations if you have the fields. If you don't have the field, you would need to modify the mapping in Elasticsearch to store it in your index. If you're using Logstash to get the logs into Elasticsearch you could look at that documentation. Here's one reference [How to query the stored, un-analyzed, form of an analyzed field?](https://discuss.elastic.co/t/how-to-query-the-stored-un-analyzed-form-of-an-analyzed-field/13334/2) If that one's not clear, search around for "not analyzed" or "raw" and you should find lots of examples. Regards, Lee ---
**Author:** ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)\ **Post date:** [October 27, 2016, 5:20pm UTC](https://discuss.elastic.co/t/kibana-is-dividing-the-urls/64139/3 "2016-10-27T17:20:25Z")
Here's another related thread; > [@How can I updated the a sub-field within an index to be not\_analyzed?](https://discuss.elastic.co/t/how-can-i-updated-the-a-sub-field-within-an-index-to-be-not-analyzed/63939): > > I have an index with a sub-filed that I want to set to be not analyzed? How can I change this? Additionally, this indexes are patterned for the day using Filebeat -- is there a way to ensure when new indices are created by Filebeat, the same not analyzed configuration takes place? Here is my index myrecords-YYYY-MM-DD: { "myrecords-2016.10.25": { "aliases": {}, "mappings": { "log": { "properties": { "@timestamp": { "type": "date", "format": "dateOptionalTime" … ---
**Author:** ![Leooel](https://avatars.discourse-cdn.com/v4/letter/l/e5b9ba/32.png) [@Leooel](https://discuss.elastic.co/u/Leooel)\ **Post date:** [October 28, 2016, 3:59pm UTC](https://discuss.elastic.co/t/kibana-is-dividing-the-urls/64139/4 "2016-10-28T15:59:32Z")
Hii Lee, This is the output parsed to elasticsearch: { "message" =\> "12.12.12.12 - - [21/Oct/2016:13:56:00 -0300] "CONNECT [some.site.com](http://some.site.com) HTTP/1.1" 503 0 TCP\_MISS:HIER\_NONE", "@timestamp" =\> "2016-10-28T11:03:54.191Z", "source" =\> "/var/log/access.log", "offset" =\> 148843, "host" =\> "logs", "IP" =\> "12.12.12.12", "ident" =\> "-", "auth" =\> "-", "Data" =\> "21/Oct/2016:13:56:00 -0300", "Metodo" =\> "CONNECT", "requisicao" =\> "[some.site.com](http://some.site.com)", "httpversion" =\> "1.1", "response" =\> "503", "bytes" =\> "0", "tcptype" =\> "TCP\_MISS:HIER\_NONE" } I tried theese thigs: - Change the field to raw - Change to not\_analized - Change to not\_analized + raw And happen the following: When raw, the URL is divided When not\_analized, don't appear the field of URL on graphic When not\_analized + raw, don't appear the field of URL on graphic When indexed: false, don't appear the field of URL on graphic I connect to the elasticsearch with dejavù app of chrome. Here the schemma: { "title": "squid3", "timeFieldName": "@timestamp", "fields": "[{"name":"Metodo","type":"string","count":0,"scripted":false,"indexed":true,"analyzed":true,"doc\_values":false},{"name":"host","type":"string","count":0,"scripted":false,"indexed":true,"analyzed":true,"doc\_values":false},{"name":"bytes","type":"string","count":0,"scripted":false,"indexed":true,"analyzed":true,"doc\_values":false},{"name":"\_source","type":"\_source","count":0,"scripted":false,"indexed":false,"analyzed":false,"doc\_values":false},{"name":"IP","type":"string","count":0,"scripted":false,"indexed":true,"analyzed":true,"doc\_values":false},{"name":"\_index","type":"string","count":0,"scripted":false,"indexed":false,"analyzed":false,"doc\_values":false},{"name":"requisicao","type":"string","count":0,"scripted":false,"indexed":true,"analyzed":true,"doc\_values":false},{"name":"message","type":"string","count":0,"scripted":false,"indexed":true,"analyzed":true,"doc\_values":false},{"name":"response","type":"string","count":0,"scripted":false,"indexed":true,"analyzed":true,"doc\_values":false},{"name":"httpversion","type":"string","count":0,"scripted":false,"indexed":true,"analyzed":true,"doc\_values":false},{"name":"@timestamp","type":"date","count":0,"scripted":false,"indexed":true,"analyzed":false,"doc\_values":true},{"name":"Data","type":"string","count":0,"scripted":false,"indexed":true,"analyzed":true,"doc\_values":false},{"name":"source","type":"string","count":0,"scripted":false,"indexed":true,"analyzed":true,"doc\_values":false},{"name":"ident","type":"string","count":0,"scripted":false,"indexed":true,"analyzed":true,"doc\_values":false},{"name":"tcptype","type":"string","count":0,"scripted":false,"indexed":true,"analyzed":true,"doc\_values":false},{"name":"offset","type":"number","count":0,"scripted":false,"indexed":true,"analyzed":false,"doc\_values":true},{"name":"auth","type":"string","count":0,"scripted":false,"indexed":true,"analyzed":true,"doc\_values":false},{"name":"\_id","type":"string","count":0,"scripted":false,"indexed":false,"analyzed":false,"doc\_values":false},{"name":"\_type","type":"string","count":0,"scripted":false,"indexed":false,"analyzed":false,"doc\_values":false},{"name":"\_score","type":"number","count":0,"scripted":false,"indexed":false,"analyzed":false,"doc\_values":false}]" } CTRL+F field of URL = requisicao || V {"name":"requisicao","type":"string","count":0,"scripted":false,"indexed":true,"analyzed":true,"doc\_values":false}, The fields changed: requisicao to requisicao.raw indexed:true to indexed:false analyzed:true to analyzed:false Did I made something wrong? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:35pm UTC](https://discuss.elastic.co/t/kibana-is-dividing-the-urls/64139/5 "2017-07-06T13:35:19Z")