Missing field in kibana visualization

Elastic Stack Kibana
1

ES version: 1.5.2 (amazon elasticearch service)

I can see below field in discover view but when I create visulization as shown in screenshot, it doesn't show this field in graph. Is there any limit of characters why below field doesn't appear in graph ? or what can I check to find the cause of this problem.

"request": "/group/support/support-desk?p_p_id=ABCommunityportlet_WAR_ABCommunity10SNAPSHOT&p_p_lifecycle=2&p_p_state=normal&p_p_mode=view&p_p_cacheability=cacheLevelPage&p_p_col_id=column-1&p_p_col_pos=5&p_p_col_count=6&_ABCommunityportlet_WAR_ABCommunity10SNAPSHOT_action=caseHistory"

2

Is there data for that during the time range?
If you take the query that KB generates can you run that and get results?

3

Yes, during the selected time range there are 5 results which kibana discover shows and I get same 5 results after running the query by curl.

But from visualization I see only 4 results.

4

What viz is it?

5

Pie chart

6

Count metric?

7

Count metric is as shown in the screenshot provided, is there something else you are asking ?

8

There is no limit on the field name. What is the field as you see it in discover? What are the mappings for this in ES and as they show up in Kibana settings?

9

I did some more debugging and found that there is an issue related with size of field value, I checked multiple fields (field name is request) with values less than or equal to 256 characters. They appear in pie chart.

But if a field value is more than 256 then it doesn't appear in pie chart (must be same for any other type of chart), I used request.raw field as shown in the screenshot above.

10

Is is something with Kibana ? Kibana version amazon elasticsearch is tied with is 4.0.3.

11

Here are the steps to reproduce this problem:

Store below logs to ES. documentTitle field has 255, 256 and 257 characters respectively, kibana Discover option shows 3 fields which is correct. Now create any visualization, eg. create pie chart, split slices with Terms Aggregation and select field as "@message.documentTitle.raw". This chart will only show 2 fields which have less than 256 characters.

{"@timestamp":"2016-01-09T03:13:24.7836248+01:00","@fields":{"level":"INFO","logger":"queryLog","properties":{"log4net:HostName":"hostMachine"},"exception":null},"@message":{"flow":"Flow1","documentTitle":"255 How to be a Programmer: A Short, Comprehensive, and Personal Summary Comprehensive, and Personal SummaryComprehensive, and Personal SummaryComprehensive, and Personal SummaryComprehensive, and Personal SummaryComprehensive, and Personal Summary asdfgh","hitNumber":3,"queryId":"06728e4a-8e53-40f4-a26d-7d81403732f8"}}

{"@timestamp":"2016-01-09T03:13:25.7836248+01:00","@fields":{"level":"INFO","logger":"queryLog","properties":{"log4net:HostName":"hostMachine"},"exception":null},"@message":{"flow":"Flow1","documentTitle":"256 HHow to be a Programmer: A Short, Comprehensive, and Personal Summary Comprehensive, and Personal SummaryComprehensive, and Personal SummaryComprehensive, and Personal SummaryComprehensive, and Personal SummaryComprehensive, and Personal Summary asdfgh","hitNumber":3,"queryId":"06728e4a-8e53-40f4-a26d-7d81403732f8"}}

{"@timestamp":"2016-01-09T03:13:26.7836248+01:00","@fields":{"level":"INFO","logger":"queryLog","properties":{"log4net:HostName":"hostMachine"},"exception":null},"@message":{"flow":"Flow1","documentTitle":"257 HHHow to be a Programmer: A Short, Comprehensive, and Personal Summary Comprehensive, and Personal SummaryComprehensive, and Personal SummaryComprehensive, and Personal SummaryComprehensive, and Personal SummaryComprehensive, and Personal Summary asdfgh","hitNumber":3,"queryId":"06728e4a-8e53-40f4-a26d-7d81403732f8"}}

Can someone please inform how this limit can be increased ?