It sounds like the field that you are using is not analyzed. I would suggest looking at this documentation: Recent data missing in dashboard/visualizations
You will likely need to create a new index with the proper mapping set up for that field so it is analyzed into A B C ... as separate values and reindex all your data into it and then you can bucket as you are trying to do.