# System.process.cmdline is blank in Kibana table visualization **URL:** \ **Category:** Kibana\ **Created:** [August 15, 2020, 10:07am UTC](https://discuss.elastic.co/t/system-process-cmdline-is-blank-in-kibana-table-visualization/245089 "2020-08-15T10:07:34Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![igorid70](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/igorid70/32/45136_2.png) [@igorid70](https://discuss.elastic.co/u/igorid70)\ **Post date:** [August 15, 2020, 10:07am UTC](https://discuss.elastic.co/t/system-process-cmdline-is-blank-in-kibana-table-visualization/245089/1 "2020-08-15T10:07:34Z")
Hi I am using Elastic stack 7.8.1 and trying to create a table summarizing Linux processes info based on metricbeat (all uses default configuration). The system metric are collected each 60 seconds and the summary table which presents all processes info calculates average of CPU usage for last 1h and then splits it into buckets per process id like shown in the screenshot. For some unclear (to me) reason some (not all) processes show system.process.cmdline empty (aggregation marks it as missing) while I do see the field with correct cmdline values when I run queries in 'Discovery' ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/d/2da9a8a4325839840e458d9bc87f5cccb62837e8.jpeg) ---
**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\ **Post date:** [August 18, 2020, 8:07am UTC](https://discuss.elastic.co/t/system-process-cmdline-is-blank-in-kibana-table-visualization/245089/2 "2020-08-18T08:07:43Z")
You are using a terms aggregation to display the value of `system.process.cmdline`. This means it's using the indexed value of this keyword field. There is a limit in the mapping for these called `ignore_above`: [https://www.elastic.co/guide/en/elasticsearch/reference/current/ignore-above.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/ignore-above.html) You can check your mapping to get the actual value, but it seems like `system.process.cmdline` is sometimes above that limit. In discover you can see the value because it's not relying on the index but on the separately stored `_source` object. There are two things you could do: - Change the `ignore_above` value to something higher and re-index existing data. - Change the mapping to store `system.process.cmdline` as type `text` as well if it's not happening already, then refresh the index pattern and use a "Top Hit" metric aggregation instead of a "Terms" bucket aggregation to show the value of `system.process.cmdline` in your table. In this case there is no limit to the length ---
**Author:** ![igorid70](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/igorid70/32/45136_2.png) [@igorid70](https://discuss.elastic.co/u/igorid70)\ **Post date:** [August 18, 2020, 8:36pm UTC](https://discuss.elastic.co/t/system-process-cmdline-is-blank-in-kibana-table-visualization/245089/3 "2020-08-18T20:36:37Z")
Thumb up. Your explanation completely makes sense. I followed your advice and it works now as expected. Appreciate your assistance. Thanks a lot. Igor ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 15, 2020, 8:36pm UTC](https://discuss.elastic.co/t/system-process-cmdline-is-blank-in-kibana-table-visualization/245089/4 "2020-09-15T20:36:43Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.