Take out bits of a URIPATH in Logstash

[magnusbaeck (Magnus Bäck)]

That's a completely different question, but in short you need to make sure the field isn't analyzed (or is analyzed differently), typically done by configuring a custom index template and setting the field in question to not_analyzed.

Related topic:

Perform Group By - Exact String

Hi, I am trying to perform group by on a string field. But as I understand, strings are tokenized and hence not able group by on the exact string. I found that it has to do with analyzer. Is there a way I can do that? Thanks in advance.