# Kibana5 data table and message term

**URL:** <https://discuss.elastic.co/t/kibana5-data-table-and-message-term/109712>\
**Category:** Kibana\
**Created:** [November 30, 2017, 9:08am UTC](https://discuss.elastic.co/t/kibana5-data-table-and-message-term/109712 "2017-11-30T09:08:59Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![MonGMZ](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mongmz/32/22386_2.png) [@MonGMZ](https://discuss.elastic.co/u/MonGMZ)\
**Post date:** [November 30, 2017, 9:08am UTC](https://discuss.elastic.co/t/kibana5-data-table-and-message-term/109712/1 "2017-11-30T09:08:59Z")

</div>

Hi all,

I'm using kibana 5 and I want to use a data table visualization but it seems that I cannot add the message as a term to it. Anyone know why is that?

Thanks.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [November 30, 2017, 10:07am UTC](https://discuss.elastic.co/t/kibana5-data-table-and-message-term/109712/2 "2017-11-30T10:07:55Z")

</div>

What is the mapping for the message field?

---

<div class="post-metadata">

**Author:** ![MonGMZ](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mongmz/32/22386_2.png) [@MonGMZ](https://discuss.elastic.co/u/MonGMZ)\
**Post date:** [November 30, 2017, 10:21am UTC](https://discuss.elastic.co/t/kibana5-data-table-and-message-term/109712/3 "2017-11-30T10:21:32Z")

</div>

Hi,

I'm using logstash 6 template by default:

```
{
  "template" : "indexname-*",
  "version" : 60001,
  "settings" : {
    "number_of_shards": "1",
    "number_of_replicas": "0",
    "index.refresh_interval" : "5s"
  },
  "mappings" : {
    "_default_" : {
      "dynamic_templates" : [ {
        "message_field" : {
          "path_match" : "message",
          "match_mapping_type" : "string",
          "mapping" : {
            "type" : "text",
            "norms" : false
          }
        }
      }, {
        "string_fields" : {
          "match" : "*",
          "match_mapping_type" : "string",
          "mapping" : {
            "type" : "text", "norms" : false,
            "fields" : {
              "keyword" : { "type": "keyword", "ignore_above": 256 }
            }
          }
        }
      } ],
      "properties" : {
        "@timestamp": { "type": "date"},
        "@version": { "type": "keyword"},
        "geoip" : {
          "dynamic": true,
          "properties" : {
            "ip": { "type": "ip" },
            "location" : { "type" : "geo_point" },
            "latitude" : { "type" : "half_float" },
            "longitude" : { "type" : "half_float" }
          }
        }
      }
    }
  },
  "aliases": { "alias_name": {} }
}'
```

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [November 30, 2017, 10:24am UTC](https://discuss.elastic.co/t/kibana5-data-table-and-message-term/109712/4 "2017-11-30T10:24:00Z")

</div>

If that is the case the `message` field is mapped as a string, which means you can not aggregate on it. Using the message field in a data table does however sound unusual. What is it you are looking to achieve?

---

<div class="post-metadata">

**Author:** ![MonGMZ](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mongmz/32/22386_2.png) [@MonGMZ](https://discuss.elastic.co/u/MonGMZ)\
**Post date:** [November 30, 2017, 10:27am UTC](https://discuss.elastic.co/t/kibana5-data-table-and-message-term/109712/5 "2017-11-30T10:27:59Z")

</div>

Our users want to display this information on the dashboard, how can I achieve this? What type of mapping should I use for the field? and more important would that be too cumbersome for the performance of the database/dashboard?  
Thanks.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [November 30, 2017, 10:31am UTC](https://discuss.elastic.co/t/kibana5-data-table-and-message-term/109712/6 "2017-11-30T10:31:31Z")

</div>

If you store your the search you want to display based on as a `saved search` in the Discover app, you can import this into a dashboard (select saved search instead of visualisation when adding) and show the raw data that way.

---

<div class="post-metadata">

**Author:** ![MonGMZ](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mongmz/32/22386_2.png) [@MonGMZ](https://discuss.elastic.co/u/MonGMZ)\
**Post date:** [November 30, 2017, 10:43am UTC](https://discuss.elastic.co/t/kibana5-data-table-and-message-term/109712/7 "2017-11-30T10:43:05Z")

</div>

Yes, I know that but last time we tried that on other index/dashboard we had lot of problems of performance even crashes. If we change the data type of the field message would be worse for the performance?  
Thanks

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [November 30, 2017, 10:46am UTC](https://discuss.elastic.co/t/kibana5-data-table-and-message-term/109712/8 "2017-11-30T10:46:11Z")

</div>

How long are your messages? What sample size have you got set in Kibana (advanced settings)?

---

<div class="post-metadata">

**Author:** ![MonGMZ](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mongmz/32/22386_2.png) [@MonGMZ](https://discuss.elastic.co/u/MonGMZ)\
**Post date:** [November 30, 2017, 10:52am UTC](https://discuss.elastic.co/t/kibana5-data-table-and-message-term/109712/9 "2017-11-30T10:52:21Z")

</div>

It's quite variable but some of the bigger ones are longer than 16K characters...

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [November 30, 2017, 10:59am UTC](https://discuss.elastic.co/t/kibana5-data-table-and-message-term/109712/10 "2017-11-30T10:59:19Z")

</div>

Have you tried reducing the sample size to see if that helps with the performance problems and crashes?

---

<div class="post-metadata">

**Author:** ![MonGMZ](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mongmz/32/22386_2.png) [@MonGMZ](https://discuss.elastic.co/u/MonGMZ)\
**Post date:** [November 30, 2017, 11:02am UTC](https://discuss.elastic.co/t/kibana5-data-table-and-message-term/109712/11 "2017-11-30T11:02:21Z")

</div>

Ok, I will try. I suppose that making such long fields as aggregatable is not a good idea, right?  
Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 28, 2017, 11:02am UTC](https://discuss.elastic.co/t/kibana5-data-table-and-message-term/109712/12 "2017-12-28T11:02:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.