# Why Kibana shoes incomplete message field **URL:** \ **Category:** Kibana\ **Created:** [August 9, 2017, 10:16pm UTC](https://discuss.elastic.co/t/why-kibana-shoes-incomplete-message-field/96519 "2017-08-09T22:16:28Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![shroh](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@shroh](https://discuss.elastic.co/u/shroh)\ **Post date:** [August 9, 2017, 10:16pm UTC](https://discuss.elastic.co/t/why-kibana-shoes-incomplete-message-field/96519/1 "2017-08-09T22:16:28Z")
I am not sure why Kibana shoes incomplete message field when logstash shoes full message on the termincal at STDOUT? Any setting i need to change ? ---
**Author:** ![spalger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spalger/32/14092_2.png) [@spalger](https://discuss.elastic.co/u/spalger)\ **Post date:** [August 10, 2017, 12:09am UTC](https://discuss.elastic.co/t/why-kibana-shoes-incomplete-message-field/96519/2 "2017-08-10T00:09:09Z")
Sorry @shroh, but I'm going to need more information in order to help. Can you provide the logstash config you are using, as well as screenshots of STDOUT and Kibana with the behavior you described? ---
**Author:** ![shroh](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@shroh](https://discuss.elastic.co/u/shroh)\ **Post date:** [August 10, 2017, 2:40pm UTC](https://discuss.elastic.co/t/why-kibana-shoes-incomplete-message-field/96519/3 "2017-08-10T14:40:33Z")
Sorry about the incomplete info: Here is the logstash config ```ruby input { beats { port => 9997 } } filter { if [fields][source] == "monic_tomcat_perf" { grok { match => {"message" => "%{MONTHDAY} %{MONTH} %{YEAR} %{TIME},%{NUMBER:duration} %{WORD:loglevel} %{WORD:Activity} \[\{%{DATA:foo1}\}\]:(.*) execution time: %{NUMBER:executionTime:float} ms"} } kv { source => "foo1" field_split => ", " } mutate { remove_field => ["foo1"] } } else if [fields][source] == "monic_web_log" { grok { match => {"message" => "(%{COMMONAPACHELOG})? Client-Correlation-Id=%{NOTSPACE:id} ResponseSecs=%{NUMBER:responsesecs} ResponseMicros=%{NUMBER:responseMicros} (\"%{URI:url}\")? %{GREEDYDATA:device}"} } } else if [fields][source] == "monic_tomcat_app" { grok { match => {"message" => "%{MONTHDAY} %{MONTH} %{YEAR} %{TIME},%{NUMBER:duration} %{WORD:loglevel}%{SPACE}%{WORD:Activity} \[\{(%{DATA:foo1})?\}\]: %{GREEDYDATA:foo2} User=\"Associate\(%{DATA:foo3}\)\""} } kv { source => "foo1" field_split => ", " } kv { source => "foo2" field_split => " " } kv { source => "foo3" field_split => ", " } } } output { elasticsearch { hosts => "localhost:9200" #manage_template => false index => harmonic_dev user => elastic password => elasticpassword } stdout { codec => rubydebug} } ``` This the log file line that i injested for reproducing this issue, the output which i see in Kibana is truncated. In the screenshot i am attaching, the first event i am talking about with latest time stamp. ```auto [%t] 08 Aug 2017 18:55:38,203 INFO HomeBaseApiConsumer [{applicationSystemCode=monicapp-app, clientIP=10.218.87.153, clusterId=Cluster-Id-NA, containerId=Container-Id-NA, correlationId=205c2806-2f97-f42f-00f5-9a43aafb9eb3, domainName=defaultDomain, hostName=ip-202-100-x.domain.com, messageId=10.202.100.34-4041d41d-75f3-4282-9aab-dd1ab17ecdf3, userId=ANONYMOUS, webAnalyticsCorrelationId=B347BC083EB9DCE4ED5005506F1F1E63|}]: KpiMetric="Cta" TransactionName="ApplicationDetail" TransactionStatus="Success" User="Associate(firstName=mike, lastName=henry, role=Consultant, email=mike@domain.com, electronicId=M422)". ``` Also i dont see the fields being parsed by logstash, it should have invoked the condition else if [source][fields] = "monic\_tomcat\_app" Not sure if my conditional statements are wrong. But two summarise the issues 1. Kibana truncating the output whereas logstash shoes full message on STDOUT 2. Fields are not being parsed and no GROk failure error. ---
**Author:** ![shroh](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@shroh](https://discuss.elastic.co/u/shroh)\ **Post date:** [August 10, 2017, 2:58pm UTC](https://discuss.elastic.co/t/why-kibana-shoes-incomplete-message-field/96519/4 "2017-08-10T14:58:10Z")
![Broken Events](https://us1.discourse-cdn.com/elastic/original/3X/3/0/309f36e5d08a70e4b36582576414b187ed063128.JPG) ---
**Author:** ![spalger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spalger/32/14092_2.png) [@spalger](https://discuss.elastic.co/u/spalger)\ **Post date:** [August 10, 2017, 7:49pm UTC](https://discuss.elastic.co/t/why-kibana-shoes-incomplete-message-field/96519/5 "2017-08-10T19:49:41Z")
Oh, are you wondering why this message is truncated? ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/4/d458c38c591593b6fe420f43dbf5c40f25e7d47f.jpg) Looks like in 5.4 the style applied to rows that are truncated in discover was changed to get rid of the gradient that use to signal that there was more to what is being presented: ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/8/4830a00a061b554b68aca24b68a8e746700a4a21.png) I'm checking with the team, not sure if this is intended or now, but if you open that row you should be able to see the whole message ---
**Author:** ![shroh](https://avatars.discourse-cdn.com/v4/letter/s/74df32/32.png) [@shroh](https://discuss.elastic.co/u/shroh)\ **Post date:** [August 11, 2017, 1:30am UTC](https://discuss.elastic.co/t/why-kibana-shoes-incomplete-message-field/96519/6 "2017-08-11T01:30:35Z")
i figured it out , i changed the setting in Kibana and can now see the whole message. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 8, 2017, 1:31am UTC](https://discuss.elastic.co/t/why-kibana-shoes-incomplete-message-field/96519/7 "2017-09-08T01:31:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.