Elasticksearch participle, causing kibana URLs to appear to be problematic

In the Kibana display page, we click on the left column of table and find that the data in Elasticsearch is the correct data in the display, such as: Agent Www.baidu.com/test, the interface will be displayed correctly as Www.baidu.com /test, but if we show this field in term,         will be divided into www.baidu.com and test two groups, by looking at Curl did not find any problems, and finally found the reason for elasticsearch to separate the results of Kibana, so Kibana will be displayed separately. Through research, our data source for Logstash automatically collected, index is automatically generated, we can not go to modify the index mapping set it to no word, so we can only start from its source, when it was created automatically set to non-participle, then we need to configure the template. The code is as follows:

Curl-xput http://localhost:9200/_template/template_1-d '{"Template":"logstash*","Order":0,"Settings": {"Number_of_shards":5},"Mappings": {"Fluentd": {"Properties": {"Request_dir":{"type":"string","Index":"not_analyzed"},"http_user_agent": {"type":"string","Index":"not_analyzed"} }}} '

One of the most important is the setting in mappings, the first level according to the data source regular decomposition, "index": "not_analyzed" for non-participle, easy to search

Elasticksearch participle, causing kibana URLs to appear to be problematic