# Missing field in kibana visualization

**URL:** <https://discuss.elastic.co/t/missing-field-in-kibana-visualization/36486>\
**Category:** Kibana\
**Created:** [December 7, 2015, 2:25am UTC](https://discuss.elastic.co/t/missing-field-in-kibana-visualization/36486 "2015-12-07T02:25:21Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![deepak\_deore](https://avatars.discourse-cdn.com/v4/letter/d/9fc29f/32.png) [@deepak\_deore](https://discuss.elastic.co/u/deepak_deore)\
**Post date:** [December 7, 2015, 2:25am UTC](https://discuss.elastic.co/t/missing-field-in-kibana-visualization/36486/1 "2015-12-07T02:25:21Z")

</div>

ES version: 1.5.2 (amazon elasticearch service)

I can see below field in discover view but when I create visulization as shown in screenshot, it doesn't show this field in graph. Is there any limit of characters why below field doesn't appear in graph ? or what can I check to find the cause of this problem.

"request": "/group/support/support-desk?p\_p\_id=ABCommunityportlet\_WAR\_ABCommunity10SNAPSHOT&p\_p\_lifecycle=2&p\_p\_state=normal&p\_p\_mode=view&p\_p\_cacheability=cacheLevelPage&p\_p\_col\_id=column-1&p\_p\_col\_pos=5&p\_p\_col\_count=6&\_ABCommunityportlet\_WAR\_ABCommunity10SNAPSHOT\_action=caseHistory"

![](https://us1.discourse-cdn.com/elastic/original/2X/a/a11884aa640cad851f031dfdf572577ab9d43b6c.png)

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [December 7, 2015, 3:28am UTC](https://discuss.elastic.co/t/missing-field-in-kibana-visualization/36486/2 "2015-12-07T03:28:11Z")

</div>

Is there data for that during the time range?  
If you take the query that KB generates can you run that and get results?

---

<div class="post-metadata">

**Author:** ![deepak\_deore](https://avatars.discourse-cdn.com/v4/letter/d/9fc29f/32.png) [@deepak\_deore](https://discuss.elastic.co/u/deepak_deore)\
**Post date:** [December 7, 2015, 7:09pm UTC](https://discuss.elastic.co/t/missing-field-in-kibana-visualization/36486/3 "2015-12-07T19:09:07Z")

</div>

Yes, during the selected time range there are 5 results which kibana discover shows and I get same 5 results after running the query by curl.

But from visualization I see only 4 results.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [December 7, 2015, 10:20pm UTC](https://discuss.elastic.co/t/missing-field-in-kibana-visualization/36486/4 "2015-12-07T22:20:27Z")

</div>

What viz is it?

---

<div class="post-metadata">

**Author:** ![deepak\_deore](https://avatars.discourse-cdn.com/v4/letter/d/9fc29f/32.png) [@deepak\_deore](https://discuss.elastic.co/u/deepak_deore)\
**Post date:** [December 7, 2015, 10:21pm UTC](https://discuss.elastic.co/t/missing-field-in-kibana-visualization/36486/5 "2015-12-07T22:21:44Z")

</div>

Pie chart

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [December 7, 2015, 10:23pm UTC](https://discuss.elastic.co/t/missing-field-in-kibana-visualization/36486/6 "2015-12-07T22:23:52Z")

</div>

Count metric?

---

<div class="post-metadata">

**Author:** ![deepak\_deore](https://avatars.discourse-cdn.com/v4/letter/d/9fc29f/32.png) [@deepak\_deore](https://discuss.elastic.co/u/deepak_deore)\
**Post date:** [December 7, 2015, 10:26pm UTC](https://discuss.elastic.co/t/missing-field-in-kibana-visualization/36486/7 "2015-12-07T22:26:46Z")

</div>

Count metric is as shown in the screenshot provided, is there something else you are asking ?

---

<div class="post-metadata">

**Author:** ![tbragin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tbragin/32/45166_2.png) [@tbragin](https://discuss.elastic.co/u/tbragin)\
**Post date:** [December 9, 2015, 4:34am UTC](https://discuss.elastic.co/t/missing-field-in-kibana-visualization/36486/8 "2015-12-09T04:34:22Z")

</div>

There is no limit on the field name. What is the field as you see it in discover? What are the mappings for this in ES and as they show up in Kibana settings?

---

<div class="post-metadata">

**Author:** ![deepak\_deore](https://avatars.discourse-cdn.com/v4/letter/d/9fc29f/32.png) [@deepak\_deore](https://discuss.elastic.co/u/deepak_deore)\
**Post date:** [December 10, 2015, 11:07pm UTC](https://discuss.elastic.co/t/missing-field-in-kibana-visualization/36486/9 "2015-12-10T23:07:12Z")

</div>

I did some more debugging and found that there is an issue related with size of field value, I checked multiple fields (field name is request) with values less than or equal to 256 characters. They appear in pie chart.

But if a field value is more than 256 then it doesn't appear in pie chart (must be same for any other type of chart), I used request.raw field as shown in the screenshot above.

---

<div class="post-metadata">

**Author:** ![deepak\_deore](https://avatars.discourse-cdn.com/v4/letter/d/9fc29f/32.png) [@deepak\_deore](https://discuss.elastic.co/u/deepak_deore)\
**Post date:** [December 15, 2015, 7:43pm UTC](https://discuss.elastic.co/t/missing-field-in-kibana-visualization/36486/10 "2015-12-15T19:43:31Z")

</div>

Is is something with Kibana ? Kibana version amazon elasticsearch is tied with is 4.0.3.

---

<div class="post-metadata">

**Author:** ![deepak\_deore](https://avatars.discourse-cdn.com/v4/letter/d/9fc29f/32.png) [@deepak\_deore](https://discuss.elastic.co/u/deepak_deore)\
**Post date:** [January 9, 2016, 8:55pm UTC](https://discuss.elastic.co/t/missing-field-in-kibana-visualization/36486/11 "2016-01-09T20:55:33Z")

</div>

Here are the steps to reproduce this problem:

Store below logs to ES. documentTitle field has 255, 256 and 257 characters respectively, kibana Discover option shows 3 fields which is correct. Now create any visualization, eg. create pie chart, split slices with Terms Aggregation and select field as "@message.documentTitle.raw". This chart will only show 2 fields which have less than 256 characters.

{"@timestamp":"2016-01-09T03:13:24.7836248+01:00","@fields":{"level":"INFO","logger":"queryLog","properties":{"log4net:HostName":"hostMachine"},"exception":null},"@message":{"flow":"Flow1","documentTitle":"255 How to be a Programmer: A Short, Comprehensive, and Personal Summary Comprehensive, and Personal SummaryComprehensive, and Personal SummaryComprehensive, and Personal SummaryComprehensive, and Personal SummaryComprehensive, and Personal Summary asdfgh","hitNumber":3,"queryId":"06728e4a-8e53-40f4-a26d-7d81403732f8"}}

{"@timestamp":"2016-01-09T03:13:25.7836248+01:00","@fields":{"level":"INFO","logger":"queryLog","properties":{"log4net:HostName":"hostMachine"},"exception":null},"@message":{"flow":"Flow1","documentTitle":"256 HHow to be a Programmer: A Short, Comprehensive, and Personal Summary Comprehensive, and Personal SummaryComprehensive, and Personal SummaryComprehensive, and Personal SummaryComprehensive, and Personal SummaryComprehensive, and Personal Summary asdfgh","hitNumber":3,"queryId":"06728e4a-8e53-40f4-a26d-7d81403732f8"}}

{"@timestamp":"2016-01-09T03:13:26.7836248+01:00","@fields":{"level":"INFO","logger":"queryLog","properties":{"log4net:HostName":"hostMachine"},"exception":null},"@message":{"flow":"Flow1","documentTitle":"257 HHHow to be a Programmer: A Short, Comprehensive, and Personal Summary Comprehensive, and Personal SummaryComprehensive, and Personal SummaryComprehensive, and Personal SummaryComprehensive, and Personal SummaryComprehensive, and Personal Summary asdfgh","hitNumber":3,"queryId":"06728e4a-8e53-40f4-a26d-7d81403732f8"}}

Can someone please inform how this limit can be increased ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 2:05pm UTC](https://discuss.elastic.co/t/missing-field-in-kibana-visualization/36486/12 "2017-07-06T14:05:25Z")

</div>


