In "Discover" my fields are looking fine, but when I want to use them in "Visualize", Kibana decides to split the fields on "space", "/", etc, which is very annoying. It is also converting everything to lowercase. Can I get in control of that? I already know about the raw-fields from logstash, but I would rather be in control.
If you don't want fields to be analyzed (i.e. if you want them to be equivalent to the .raw subfields), update Logstash's index template so that the fields are not_analyzed.
(This isn't really a Kibana question. Kibana only presents what the Elasticsearch indexes contain, and Logstash feeds Elasticsearch.)
Oh, so that's why. Thanks for clearing that out. Still pretty new to this.