Hi,
your are very likely running into this problem: Cannot display string in a visualization table of more than 256 letters
If your field is indexed as keyword and the length of the content is longer than ignore_above
, it will show up in Discover (because it uses the _source
object), but it won't work in visualizations, because aggregations are done on the indexed values (and everything above ignore_above
is not indexed).
Increasing the value in your mapping and re-ingesting existing data should fix the problem.
If this doesn't help, please share the mapping of your index here, maybe something else is going wrong.