Problem with Terms getting split

I have a data field like so:
"PrimaryAssembly" => "Respiratory Structure & Function"

In Kibana, the field is split on the whitespace. So when I create a pie chart, my legend has the following choices:

  • Respiratory
  • Structure
  • Function

How do Get my complete Term as an item on the legend? I don't want the Terms split like that.

The string field PrimaryAssembly is being "analyzed" by ES. You can either:

  1. Create a template and set {"index": "not_analyzed"} for any string field that matches a pattern. In your case, it would be {"match": "PrimaryAssembly"} (this requires re-indexing the data)
    OR
  2. Add a raw sub-field (i.e. PrimaryAssembly.raw) and set it to be "not_analyzed". This is probably ideal if you don't want to re-index. But any saved searches and Kibana charts will have to be edited to reference the new "not_analyzed" field

https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-put-mapping.html

I understood, but how do you add a .raw field in Kibana?

There are many ways, depends on what you want to do. For example, if you want every string field in all indices created from now on to have a raw "not_analyzed" subfield, you can create a dynamic template that matches all (or just certain indices and fields). The example below create a new dynamic template named "receipt". Any new indices created with name matches the pattern "receipt-*" (defined by the template parameter) will have all of its string fields, regardless of name (this can be controlled by the match parameter), appended with a raw subfield:

PUT /_template/receipt

{
        "order" : 0,
        "template" : "receipt-*",
        "settings" : {
            "index" : {
                "refresh_interval" : "5s"
            }
        },
        "mappings" : {
            "_default_" : {
                "dynamic_templates" : [{
                        "message_field" : {
                            "mapping" : {
                                "index" : "analyzed",
                                "omit_norms" : true,
                                "type" : "string",
                                "fields" : {
                                    "raw" : {
                                        "ignore_above" : 256,
                                        "index" : "not_analyzed",
                                        "type" : "string"
                                    }
                                }
                            },
                            "match_mapping_type" : "string",
                            "match" : "message"
                        }
                    }, {
                        "string_fields" : {
                            "mapping" : {
                                "index" : "analyzed",
                                "omit_norms" : true,
                                "type" : "string",
                                "fields" : {
                                    "raw" : {
                                        "ignore_above" : 256,
                                        "index" : "not_analyzed",
                                        "type" : "string"
                                    }
                                }
                            },
                            "match_mapping_type" : "string",
                            "match" : "*"
                        }
                    }
                ],
                "_all" : {
                    "omit_norms" : true,
                    "enabled" : true
                },
                "properties" : {
                    "geoip" : {
                        "dynamic" : true,
                        "type" : "object",
                        "properties" : {
                            "location" : {
                                "type" : "geo_point"
                            }
                        }
                    },
                    "@version" : {
                        "index" : "not_analyzed",
                        "type" : "string"
                    }
                }
            }
        },
        "aliases" : {}

    }

Why don't you refer to the doc, post what you have been working on, articulate what you want and allow the folks here to provide feedback.