Terms aggregation is breaking field into tokens

Elastic Stack Elasticsearch
1

I am using terms aggregation in elasticsearch something like

"aggs": {
"url": {
"terms": {
"field": "request"
}
}
}

My request field have values like "GET /" or "GET /test.html" . When I execute above query the output has buckets with

"buckets": [
{
"key": "get",
"doc_count": 436830
},
{
"key": "test.html",
"doc_count": 2
}
]

I can see that it broke request field into multiple tokens and made it buckets. How to use aggregation with exact field ? I expect buckets to be "GET /" and "GET /test.html" .Please help

2

You probably stored the data in the field you are running the aggregation on in analyzed form. This means that the string stored in this field is split into what Elasticsearch thinks are distinct tokens/words. What you want instead is to store your data as "not_analyzed". For more information see also here:

https://www.elastic.co/guide/en/elasticsearch/guide/current/mapping-intro.html

Hope this helps,
Isabel