# Discover tab shows data but table vizualization shows empty

**URL:** <https://discuss.elastic.co/t/discover-tab-shows-data-but-table-vizualization-shows-empty/238788>\
**Category:** Kibana\
**Created:** [June 26, 2020, 5:51am UTC](https://discuss.elastic.co/t/discover-tab-shows-data-but-table-vizualization-shows-empty/238788 "2020-06-26T05:51:28Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![katara](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/katara/32/60143_2.png) [@katara](https://discuss.elastic.co/u/katara)\
**Post date:** [June 26, 2020, 5:51am UTC](https://discuss.elastic.co/t/discover-tab-shows-data-but-table-vizualization-shows-empty/238788/1 "2020-06-26T05:51:28Z")

</div>

Hi,  
Heres the data in Discover tab

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/b/0b5fb8e77484a5e0616a8e47a5553af97323f66e.png)

And when the same is included in the Data table vizualization, the message is blank.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/8/885cbe5d110ed6283b52c2db687fbca69235695d.png)

I tried using top hit as well, all shows blank.  
Please help me fix this.

Thanks!

---

<div class="post-metadata">

**Author:** ![matw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matw/32/13913_2.png) [@matw](https://discuss.elastic.co/u/matw)\
**Post date:** [June 30, 2020, 5:33am UTC](https://discuss.elastic.co/t/discover-tab-shows-data-but-table-vizualization-shows-empty/238788/2 "2020-06-30T05:33:28Z")

</div>

Hi Karara

There are some warning icons displayed, could you hover the one at log message with the mouse and tell me what kind of warning is displayed? Think your problem might have to do with this.

Thx & Best,  
Matthias

---

<div class="post-metadata">

**Author:** ![katara](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/katara/32/60143_2.png) [@katara](https://discuss.elastic.co/u/katara)\
**Post date:** [June 30, 2020, 7:18am UTC](https://discuss.elastic.co/t/discover-tab-shows-data-but-table-vizualization-shows-empty/238788/3 "2020-06-30T07:18:56Z")

</div>

@matw, Thank you. I am not using those fields with a warning,  
these fields are rather encoded with base64. which could be the reason.

I tried saving a discover table with appropriate columns, which works well, but a data table seems to ignore all columns with large character counts.

Katara.

---

<div class="post-metadata">

**Author:** ![matw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matw/32/13913_2.png) [@matw](https://discuss.elastic.co/u/matw)\
**Post date:** [June 30, 2020, 7:53am UTC](https://discuss.elastic.co/t/discover-tab-shows-data-but-table-vizualization-shows-empty/238788/4 "2020-06-30T07:53:21Z")

</div>

could you paste an example document here and the mapping in Elasticsearch you're using? many thx!  
Matthias

---

<div class="post-metadata">

**Author:** ![katara](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/katara/32/60143_2.png) [@katara](https://discuss.elastic.co/u/katara)\
**Post date:** [July 3, 2020, 12:37pm UTC](https://discuss.elastic.co/t/discover-tab-shows-data-but-table-vizualization-shows-empty/238788/5 "2020-07-03T12:37:25Z")

</div>

This data eventually comes from a log shipper,  
and the below is my logstash configuration:

> ```
> input {
> tcp {
> port => 8443
> codec => json_lines { charset => CP1252 }
> }
> }
> filter
> {
> ruby {
> code => "
> event.set('logmessage', Base64.encode64(event.get('[Message]')))
> event.set('device', Base64.encode64(event.get('[Hostname]')))
> event.set('sev', Base64.encode64(event.get('[Severity]')))
> event.set('tagpath', Base64.encode64(event.get('[tag_filepath]')))
> event.set('appname', Base64.encode64(event.get('[ApplicationName]')))
> "
> }
> mutate {
> gsub => [
> # replace all forward slashes with underscore
> "Hostname", " ", "_",
> "Severity", " ", "",
> "tag_filepath", " ", "_",
> "ApplicationName", " ", "_",
> "Message", " ", "_"
> ]
> }
> }
> output {
> elasticsearch {
> hosts => ["10.1.1.1:9200"]
> user => "elastic"
> password => " *******"
> index => "nxlogapps"
> }
> stdout { codec => rubydebug }
> }
> 
> ```

---

<div class="post-metadata">

**Author:** ![matw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matw/32/13913_2.png) [@matw](https://discuss.elastic.co/u/matw)\
**Post date:** [July 6, 2020, 6:46am UTC](https://discuss.elastic.co/t/discover-tab-shows-data-but-table-vizualization-shows-empty/238788/6 "2020-07-06T06:46:42Z")

</div>

Visualization usually use the keyword type of Elasticsearch for such cases, could you check the ignore\_above settings of the indices mappings? Could be a reason why longer messages are ignored [https://www.elastic.co/guide/en/elasticsearch/reference/current/keyword.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/keyword.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 3, 2020, 6:46am UTC](https://discuss.elastic.co/t/discover-tab-shows-data-but-table-vizualization-shows-empty/238788/7 "2020-08-03T06:46:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.