Not able to aggregate with multiple terms

Hello,

I am stuck at aggregate query.
I have a message, matched_id and host.name field, query works if i do not include message.keyword in aggregation. I cannot seem to group over messages? Please help.

GET /pattern_match-*/_search
{
  "size": 0,
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "matched_id": {
              "query": "911"
            }
          }
        },
        {
          "range": {
            "@timestamp": {
              "from": "now-1d",
              "to": "now"
            }
          }
        }
      ]
    }
  },
  "aggregations": {
    "critical_host": {
      "terms": {
        "field": "host.name.keyword"
      },
      "aggregations": {
        "message_info": {
          "terms": {
            "field": "message.keyword"
          },
          "aggregations": {
            "count_of_matched_id": {
              "value_count": {
                "field": "matched_id.keyword"
              }
            }
          }
        }
      }
    }
  }
}

Console:

Index:

Discover:

Thanks

“message” field contains more than 500 characters, could this be the reason for aggregation to not work?

Resolved.
It was indeed because it was overlooking keywords above 256 characters.
“ignore_above” : 256
YOu can find it with this: GET /your_indexname/_mapping