Curl to elasticsearch ELK cluster doesn't bring back current data whereas Kibana does

Elastic Stack Logstash
1

On Kibana, I see all current data all the time.

But when I do a

curl -XGET 'http://elkcluster:9200/logstash-YYYY.MM.DD/_search?host=somehost&type=heartbeat'

it shows me out of date logstash heartbeats.

I go back to Kibana and everything is uptodate with respect to heartbeats and all other data from the host to ELK.

Why is curl out-of-date?

The logstash shipper log on the "some host" shows current heartbeats being sent with current timestamps a minute apart going back from wall clock time.

2

All timestamps in Elasticsearch are stored in UTC timezone, and time based index patterns are also based on UTC. Kibana is however able to adjust for your local timezone, which could explain the difference. Which timezone are you in?

3

Systems are all UTC.

4

Can you show an example of an out of date logstash record?