Cannot display string in a visualization table of more than 256 letters

[reyhanadp (reyhan audian dwi putra)]

hi everyone.

I have an example string that has a length of 256 as follows:

Could not start executor. A required privilege is not held by the client. (Exception from HRESULT: 0x80070522) RemoteException wrapping System.Exception: Could not start executor. A required privilege is not held by the client. (Exception from HRESULT: 0x

if the string length is less than equal to 256 then it can be displayed in the Kibana visualization table.

but if I convert the data into a string whose length is above 256 then the data cannot be displayed in the Kibana visualization table.

Could not start executor. A required privilege is not held by the client. (Exception from HRESULT: 0x80070522) RemoteException wrapping System.Exception: Could not start executor. A required privilege is not held by the client. (Exception from HRESULT: 0x80070522)

but the data can be displayed on Kibana discover

why did it happen like that?
does the visualization table have a string limit?
help please. thanks.

[flash1293 (Joe Reuter)]

Hi @reyhanadp,

Discover shows the source of a document - this is the JSON as it looked like when the document got ingested in Elasticsearch.

Visualizations (as the table visualization) however work differently - they are using aggregations to fetch data which relies on the indexed values of the fields, not the raw contents during ingestion. In your case Message is probably a keyword field with a length of 256. You can confirm this by looking up your mapping:

GET /kibana_sample_data_logs/_mapping/field/extension.keyword

{
  "kibana_sample_data_logs" : {
    "mappings" : {
      "extension.keyword" : {
        "full_name" : "extension.keyword",
        "mapping" : {
          "keyword" : {
            "type" : "keyword",
            "ignore_above" : 256
          }
        }
      }
    }
  }
}

In this example the extension.keyword field has an ignore_above property of 256 which means everything after the 256th character won't be indexed and thus is not known to the table visualization.

You could try to increase that limit and re-index your data, but your case looks like you want to show individual documents in a table format on a dashboard. The "table" visualization is not the right tool for this, you can configure the columns you want to see in Discover and save it as a "Saved search". Then you can add this saved search to the dashboard and it won't have the character limit issue as it will use the source object just like Discover. https://www.elastic.co/guide/en/kibana/current/save-open-search.html