Visualisation Shows "Missing" instead of the actual value

[roders1234]

Hi,

I've been scouring Google and any where else I can find to a solution to this problem, or even an explanation of why this happens... So I'm hoping someone here can help me out!

I have several visualisation that attempt to show an aggregate count of the log message that was posted (E.G. Payment failed due to incorrect card details). I have these grouped in a chart, but several of the messages are grouped as "Missing" instead of the full message. Where as other messages are fine.

I suspect that this has something to do with the characters used within the message; I cannot post the actual message (security) but an example would be,

[Lorem=ipsum-1] dolor sit -8 amet.

[joshdover]

Hi there,

You should only see the "Missing" value if the field indexed field is empty. If you're using a keyword field to group on, you may want to check to see if your token filter or analyzer for that field mapping is stripping out all the content.

You can see the results of the analyzer by querying for the doc id and in Console and checking that keyword field (make sure you're not looking in _source) or testing your analyzer.

Let me know if that helps!