Not_Analyzed Field Splits On Spaces

Elastic Stack Kibana
1

I have a field marked as type string, not_analyzed. When visualising data from this field each word is separated.
It is as if the field were mapped as analyzed.
I have another index which has the same field not_analyzed and visualisation does not separate the words in the string.
Perhaps a bug?

2

May need more details here. Could you post the mapping in ES and a screenshot of how you are creating the visualization?

3

Just a simple mapping:
(extract)
},
"source_name" : {
"index" : "not_analyzed",
"type" : "string"
}

With the visualisation it is just a basic pie or bar chart.
So, with a bar chart using the timestamp for X-Axis and a Split Bar Sub Aggregation using terms and them 'source_name' field for example.
If the value of the source_name field is "my own application" then the bar will be split into my, own and application.
The same with a pie chart. It's as if the field is mapped as analyzed.

4

I've not seen that happen. And you say you have another index where this works as expected? Any errors on the Elasticsearch side?

5

I'm seeing this issue as well. In my case it also extends to the queries being run directly on elasticsearch. In my example it's a field being generated from 3 copy_to statements

        "field_1": {
            "type": "string",
            "fields": {
              "raw": {
                "ignore_above": 256,
                "index": "not_analyzed",
                "type": "string"
              }},
            "copy_to": "field_123"
        }, 
        "field_2": {
            "type": "string",
            "fields": {
              "raw": {
                "ignore_above": 256,
                "index": "not_analyzed",
                "type": "string"
              }},
            "copy_to": "field_123"
        }, 
        "field_3": {
            "type": "string",
            "fields": {
              "raw": {
                "ignore_above": 256,
                "index": "not_analyzed",
                "type": "string"
              }},
            "copy_to": "field_123"
        },
        "field_123" :{
            "type": "string",
            "index": "not_analyzed"
        }
6

I'm seeing this issue. Have you found a solution to this?