Unable to disable analyzed

Elastic Stack Elasticsearch
1

I have field called 'PrimaryAssembly' that I don't want broken into tokens.
For example, I don't want 'Allergy & Immunology' broken into 'Allergy' and 'Immunology'.
I want those words whole for when I create a pie chart.

I tried using a custom index template by referencing it in my logstash config as so:

output{

        elasticsearch {
                index=>"assemblies"
                hosts => ["localhost:9200"]
                template => "/home/ubuntu/templates/assemblies_template.json"
        }

        stdout {codec=>rubydebug}

}

I tried setting my fields to "not_analyzed", but this is not working.
When I create a pie chart, my legend is still using tokenized words, 'allergy' and 'immunology'.

In addition, my raw fields are not showing up in Kibana.

Here is a portion of my template:
{
"template" : "assemblies",
"settings" : {
"index.refresh_interval" : "5s"
},
"mappings" : {
"default" : {
"_all" : {"enabled" : true, "omit_norms" : true},
"dynamic_templates" : [ {
"message_field" : {
"match" : "message",
"match_mapping_type" : "string",
"mapping" : {
"type" : "string", "index" : "not_analyzed", "omit_norms" : true,
"fielddata" : { "format" : "disabled" }
}
}
}, {
"string_fields" : {
"match" : "*",
"match_mapping_type" : "string",
"mapping" : {
"type" : "string", "index" : "not_analyzed", "omit_norms" : true,
"fielddata" : { "format" : "disabled" },
"fields" : {
"raw" : {"type": "string", "index" : "not_analyzed", "doc_values" : true, "ignore_above" : 256}
}
}
}
}

2

Did you recreate and reindex the assemblies index? The index template only applies to new indexes.

3

Yes, I did. both in elasticsearch and kibana.

4

Ok, I realized I was doing this all wrong.
What almost works is running a curl -XPUT command for the mapping I want.

I get better results, but I see my terms are getting grouped together.
I get 'Term 1' , 'Term 2'. but some slices of the pie chart have 'Term 1, Term 2' merged together.

I got what I finally wanted by changing the metric from 'unique count' to count.
I noticed the results and terms are different depending on how I 'Order by'

Thanks for the help! This seems to work!