The logs on kibana are truncated in the message field ( maximum 1000 characters). If I open the json the message is complete (about 150,000 characters)
It seems to be a kibana limitation problem because even from devtools with the GET command nameindex/_searchsearch I can see the full message.
The version of Elasticsearch is v 7.17.22
how the message field mapped? Is it text or keyword, or rather both?
1 Like
Hi Marco,
The type is text. I found that in index_patterns on kibana the format is Trucated String and the field length is 1000!
I did some tests and saw that the problem is due to this.
The fact remains that when I try to disable “set format” after a while I see that the configuration reverts to truncate string.
Is this due to some setting or only users can change it?
Just to confirm: you mean that dataView configuration changes without any user input when disabling the set format on the field?
Yes exactly. That was the question.
Can you give me some advice? Thank you
It sounds strange to be honest.
I had a look at the issues about this topic but could not find any.
Are you able to reproduce it in a stable way? Can you pinpoint an action that triggers this behaviour?
1 Like
Currently I cannot reproduce the problem. Currently after several days of observation the value has remained the same.
At this point I would say to close the report.
Thank you very much for your support