# Problem with Terms getting split

**URL:** <https://discuss.elastic.co/t/problem-with-terms-getting-split/35932>\
**Category:** Kibana\
**Created:** [November 30, 2015, 5:28pm UTC](https://discuss.elastic.co/t/problem-with-terms-getting-split/35932 "2015-11-30T17:28:08Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mc1392](https://avatars.discourse-cdn.com/v4/letter/m/57b2e6/32.png) [@mc1392](https://discuss.elastic.co/u/mc1392)\
**Post date:** [November 30, 2015, 5:28pm UTC](https://discuss.elastic.co/t/problem-with-terms-getting-split/35932/1 "2015-11-30T17:28:08Z")

</div>

I have a data field like so:  
"PrimaryAssembly" =\> "Respiratory Structure & Function"

In Kibana, the field is split on the whitespace. So when I create a pie chart, my legend has the following choices:

- Respiratory
- Structure
- Function

How do Get my complete Term as an item on the legend? I don't want the Terms split like that.

---

<div class="post-metadata">

**Author:** ![vtst2412](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vtst2412/32/6228_2.png) [@vtst2412](https://discuss.elastic.co/u/vtst2412)\
**Post date:** [November 30, 2015, 5:54pm UTC](https://discuss.elastic.co/t/problem-with-terms-getting-split/35932/2 "2015-11-30T17:54:42Z")

</div>

The string field PrimaryAssembly is being "analyzed" by ES. You can either:

1. Create a template and set `{"index": "not_analyzed"}` for any string field that matches a pattern. In your case, it would be `{"match": "PrimaryAssembly"}` (this requires re-indexing the data)  
OR
2. Add a raw sub-field (i.e. PrimaryAssembly.raw) and set it to be "not\_analyzed". This is probably ideal if you don't want to re-index. But any saved searches and Kibana charts will have to be edited to reference the new "not\_analyzed" field

[https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-put-mapping.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-put-mapping.html)

---

<div class="post-metadata">

**Author:** ![mc1392](https://avatars.discourse-cdn.com/v4/letter/m/57b2e6/32.png) [@mc1392](https://discuss.elastic.co/u/mc1392)\
**Post date:** [November 30, 2015, 9:43pm UTC](https://discuss.elastic.co/t/problem-with-terms-getting-split/35932/3 "2015-11-30T21:43:04Z")

</div>

I understood, but how do you add a .raw field in Kibana?

---

<div class="post-metadata">

**Author:** ![vtst2412](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vtst2412/32/6228_2.png) [@vtst2412](https://discuss.elastic.co/u/vtst2412)\
**Post date:** [November 30, 2015, 10:13pm UTC](https://discuss.elastic.co/t/problem-with-terms-getting-split/35932/4 "2015-11-30T22:13:56Z")

</div>

There are many ways, depends on what you want to do. For example, if you want every string field in **all** indices created from now on to have a raw "not\_analyzed" subfield, you can create a dynamic template that matches all (or just certain indices and fields). The example below create a new dynamic template named "receipt". Any new indices created with name matches the pattern "receipt-\*" (defined by the `template` parameter) will have all of its string fields, regardless of name (this can be controlled by the `match` parameter), appended with a raw subfield:

`PUT /_template/receipt`

```
{
        "order" : 0,
        "template" : "receipt-*",
        "settings" : {
            "index" : {
                "refresh_interval" : "5s"
            }
        },
        "mappings" : {
            "_default_" : {
                "dynamic_templates" : [{
                        "message_field" : {
                            "mapping" : {
                                "index" : "analyzed",
                                "omit_norms" : true,
                                "type" : "string",
                                "fields" : {
                                    "raw" : {
                                        "ignore_above" : 256,
                                        "index" : "not_analyzed",
                                        "type" : "string"
                                    }
                                }
                            },
                            "match_mapping_type" : "string",
                            "match" : "message"
                        }
                    }, {
                        "string_fields" : {
                            "mapping" : {
                                "index" : "analyzed",
                                "omit_norms" : true,
                                "type" : "string",
                                "fields" : {
                                    "raw" : {
                                        "ignore_above" : 256,
                                        "index" : "not_analyzed",
                                        "type" : "string"
                                    }
                                }
                            },
                            "match_mapping_type" : "string",
                            "match" : "*"
                        }
                    }
                ],
                "_all" : {
                    "omit_norms" : true,
                    "enabled" : true
                },
                "properties" : {
                    "geoip" : {
                        "dynamic" : true,
                        "type" : "object",
                        "properties" : {
                            "location" : {
                                "type" : "geo_point"
                            }
                        }
                    },
                    "@version" : {
                        "index" : "not_analyzed",
                        "type" : "string"
                    }
                }
            }
        },
        "aliases" : {}

    }

```

Why don't you refer to [the doc](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html), post what you have been working on, articulate what you want and allow the folks here to provide feedback.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 2:07pm UTC](https://discuss.elastic.co/t/problem-with-terms-getting-split/35932/5 "2017-07-06T14:07:51Z")

</div>