Hi @reyhanadp,
Discover shows the source of a document - this is the JSON as it looked like when the document got ingested in Elasticsearch.
Visualizations (as the table visualization) however work differently - they are using aggregations to fetch data which relies on the indexed values of the fields, not the raw contents during ingestion. In your case Message is probably a keyword field with a length of 256. You can confirm this by looking up your mapping:
GET /kibana_sample_data_logs/_mapping/field/extension.keyword
{
"kibana_sample_data_logs" : {
"mappings" : {
"extension.keyword" : {
"full_name" : "extension.keyword",
"mapping" : {
"keyword" : {
"type" : "keyword",
"ignore_above" : 256
}
}
}
}
}
}
In this example the extension.keyword field has an ignore_above property of 256 which means everything after the 256th character won't be indexed and thus is not known to the table visualization.
You could try to increase that limit and re-index your data, but your case looks like you want to show individual documents in a table format on a dashboard. The "table" visualization is not the right tool for this, you can configure the columns you want to see in Discover and save it as a "Saved search". Then you can add this saved search to the dashboard and it won't have the character limit issue as it will use the source object just like Discover. https://www.elastic.co/guide/en/kibana/current/save-open-search.html