Kibana 6.4 chracter limit?

(Ufkun Karaman) #1

I use elk 6.4
How can I solve the problem ? ( The problem is missing value ??)

(Jon Budzenski) #2

Can you verify that 'Missing' is coming from Kibana and not the elasticsearch document? What's your workflow used to ingest these documents?

I believe Kibana will use a hyphen if the field is empty.

(Ufkun Karaman) #3

My system => (syslog (5000 port udp) => logstash => elasticsearch => kibana )
I parse message on logstash.
if ı want to send 300 characters log , I can see kibana's discovery or kibana's dev tool
but if ı look this info on kibana's visualize , ı can not see ( ı see "missing") (???)

(Jon Budzenski) #4

My apologies, I had to do some research. The "Missing" text is roughly saying we have a sub bucket that is empty. I'm guessing this is related to the number of terms aggregations we're doing, it's splitting the data up several times.

Can you add some info about how you want this data table to look? If it's a document level view creating this from discover instead of visualize may be what we're looking for

(jonsmith) #5

what version of Kibana are you on? what happens when you remove the offending visualization?

(Ufkun Karaman) #6

My table like - syslog_priority -timestamp -syslog_hostnames -syslog_program- syslog_process- syslog_massage_id- syslog_message

logstash parsing like that =>
match => [ "message","%{POSINT:syslog_priority} %{TIMESTAMP_ISO8601:syslog_time} %{SYSLOGPROG:syslog_program} %{SYSLOGHOST:syslog_hostname} %{NOTSPACE:syslog_process} %{NOTSPACE:syslog_massage_id} %{NOTSPACE:syslog_level} %{GREEDYDATA:syslog_message}" ]

(Ufkun Karaman) #7

I use Kibana version -> 6.4.0 . And ı try Kibana -> 6.2.4 .I take same result.The problem is that the "missing" error. The aim is to solve the "missing" error .and show those lost data.(missing error seems if the characters numbers are 300 (if the characters numbers are 200 , data will seen) )

(Jon Budzenski) #8

Hi Ufkun, I think the best place for this is from discover and it should be able to achieve what you want. When you hover over a field on the left hand side of the page, you can add the column. Saving the search from discover will let you add this table to a dashboard.

Do you think this will work for you?

(Ufkun Karaman) #9

Thank your answer.At the moment your answer is best answer but not solution.I will work here .Thanks for helping

(system) #10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.