I have a search with custom output, setting the hostname as a column. The weird thing is that I cannot set the width of the column at certain size, as soon as I press enter is reverts to the original size in which the hostname column is as wide as the message and it uses way too much space that it’s empty, instead of having useful information …
I have a wazuh installation with opensearch (a bit older) that doesn’t have the same problem …
I just tested this out in my lab. My test consist of using the Discover. I then configured it to Timestamp host.name message as shown in your screenshot above.
When I first saved it it acted the same way you mentioned. I corrected it and hit the "save’ button not the “enter” button.
I then adjusted the width of the host.name column back again but this time it stayed.
Next, I logged out and back in (same user), I click the “open” button and the width of the host.name column when back like your issue. So im not sure whats up, perhaps its a bug and if so I would post it in Github.
