You are running a terms aggregation on the message.keyword field, and keywords by default will ignore entries greater than 1024 characters. If you view the index mapping for your index, it should be spelled out there. You could use the "top hit" metric to display long messages instead. Something like this:
1 Like