Logstash GROK Visualize

Hi, I am using GROK to split out my log messages into fields.
Some message fields have multiple words as a result e.g. login authentication succeeded or login authentication failed.
When I go to Kibana, Discover, find the log and then on the left hand side pane expand the relivant field I can see them both one above the other l but when I click on visualise it creates 4 bar charts "authentication", "login", "succeeded" and "failed".

Have noticed I also have a warning message next to Visualize - 1 warning - This is an analyzed string field. Analyzed strings are highly unique and can use a lot of memory to visualize.....

Is there any way to fix up the GROK to keep the messages together.

In GROK I'm capturing this part as %{CISCO_REASON:login_authentication_response}.

This is unrelated to grok. The problem is that the field stored in Elasticsearch is analyzed. You should have a .raw subfield that you can use, or you can use an index template to change the field's configuration to not be analyzed.

Thanks Magnus.
Got any good links with examples on how I can do this?

I don't have anything specific but index templates and how to mark fields as non-analyzed has been covered here many many times before and index templates in general is of course included in the ES documentation.