# Kibana can't display raw field after a certain time?

**URL:** <https://discuss.elastic.co/t/kibana-cant-display-raw-field-after-a-certain-time/55671>\
**Category:** Kibana\
**Created:** [July 16, 2016, 4:09pm UTC](https://discuss.elastic.co/t/kibana-cant-display-raw-field-after-a-certain-time/55671 "2016-07-16T16:09:30Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kennedy\_Kan1](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\
**Post date:** [July 16, 2016, 4:09pm UTC](https://discuss.elastic.co/t/kibana-cant-display-raw-field-after-a-certain-time/55671/1 "2016-07-16T16:09:30Z")

</div>

I am using logstash to collect some mssql metrics with PerfMon. There is a field called host.raw which seems to auto-generate itself. I have created some visualizations on the kibana and it runs well for the first few days. However, after likely 3 days, the visualization cannot display charts based on the host.raw field. What could be the problem?

 ![](https://us1.discourse-cdn.com/elastic/original/2X/2/21e3913c97595fc4b7daa4dd46c692ed84cd1706.png)

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 17, 2016, 6:13am UTC](https://discuss.elastic.co/t/kibana-cant-display-raw-field-after-a-certain-time/55671/2 "2016-07-17T06:13:48Z")

</div>

Does data exist in the field for newer docs?

---

<div class="post-metadata">

**Author:** ![Kennedy\_Kan1](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\
**Post date:** [July 17, 2016, 7:13am UTC](https://discuss.elastic.co/t/kibana-cant-display-raw-field-after-a-certain-time/55671/3 "2016-07-17T07:13:26Z")

</div>

Yes. Data still exists. At least when I am not using raw field, i.e. host field, it can display result. However, host is an analyzed field which means kibana will parse them down to separate words when my host name have more than 1 string or when the host name contains - ,thus, the results are not properly displayed. For example, my host is win-7, when I use host field for x axis, it will display 2 column, one win and one 7 instead of a single column win-7. But when I use host.raw, it will only display a single column of win-7 which is then the correct result. However, I can only use host field but not host.raw field now. Therefore, I don't quite understand how this happen

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:46pm UTC](https://discuss.elastic.co/t/kibana-cant-display-raw-field-after-a-certain-time/55671/4 "2017-07-06T13:46:21Z")

</div>


