Hello, @Joe_Fleming
Today I have added a new field "message_sha1" to logstash configuration.
And when I change my data table field from "msg.raw" to "message_sha1.raw", I see all rows. But if I add yet another sub-aggregation level by "msg.raw" field, the rows with a big length of "msg.raw" are disappearing.
So, I think, the main problem is a length of "msg.raw".