Why comments field not being displayed

[Dana_Pavaday]

Why is the comment field not being displayed for some Affected Services field values (Memory, CPU) in the Dashboard when they are already being displayed in Discover?

Is this an issue with the logstash? What should be done to solve this?

[carly.richmond]

Hi @Dana_Pavaday,

Can you share a screenshot of where you're not able to see the comment field? If the field is visible in Discover it sounds like the data has made it into Elasticsearch from Logstash.

[Dana_Pavaday]

Hello @carly.richmond,

Please find the attached screenshot. The comment field is not displayed for Memory, CPU and Disk I/O. But it is displayed for Connectivity. And in Discover, we can see that Memory, CPU and Disk I/O have comments.

[carly.richmond]

Thanks @Dana_Pavaday. What is your configuration for the Commentaire field in the table? And what is the expected value you think should be present for your Memory and Connectivity values?

[Dana_Pavaday]

Hello @carly.richmond,

Thank you for your help. I have been able to resolve the issue. The number of characters for the comment field was too long. I have truncated it.

[Dana_Pavaday]

Hello @carly.richmond,

The comment field is dropped from Kibana since it is too long. Is there a variable to extend the length of the field?

[carly.richmond]

Hi @Dana_Pavaday,

Just a few questions from me to help. Is this a text field, or another field type? How long is the field that you needed to truncate. Are you making use of the ignore_above setting?

[Dana_Pavaday]

Hello @carly.richmond,

It is a text field and I guess it is longer than the default maximum field length in elastic. No, am not making use of the ignore_above setting.

[carly.richmond]

Thanks for clarifying @Dana_Pavaday. It would be useful to have a rough idea of size of the field.

I did find this old thread and the blog post mentioned in that thread that talks about the underlying Lucene limit that I wonder if you might be hitting:

And even if you do raise the Elasticsearch limit, you cannot exceed the hard Lucene limit of 32k for a single token, and Elasticsearch certainly logs some messages that exceed this.

I would recommend having a look at setting your ignore_above limit in line with the note at the bottom of the documentation and seeing if that helps when the document is reingested.