kibana unique count seeing names with - as different entery

Question

I have an problem with the unique count feature. I get data from elasticsearch for example an computer name (PC-01) in a field. When i want to use a visualisation unique count then kibana makes from "DESKTOP-2D562R2" -> "DESKTOP" and "2D562R2" as a entery.

See this splitted field:

The data kibana gets from elastic search looks like this entery data:

The problem with this is that 2d562r2 and desktop two different "enterys" are in a kibana table or with unique count.

Answer 1

Your field is being analyzed (split into tokens). Change the mapping (or template, depending on how you're creating the indexes) to make this field not_analyzed.

Note that, as a hack, logstash's default template creates a ".raw" version of string fields that is not analyzed. You could refer to enterys.raw.