# Date Histogram Problem

**URL:** https://discuss.elastic.co/t/date-histogram-problem/71969
**Category:** Kibana
**Created:** [January 18, 2017, 10:01am UTC](https://discuss.elastic.co/t/date-histogram-problem/71969 "2017-01-18T10:01:57Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Jeremy\_Cugmas](https://avatars.discourse-cdn.com/v4/letter/j/a88e4f/32.png) [@Jeremy\_Cugmas](https://discuss.elastic.co/u/Jeremy_Cugmas)
#### Post date: [January 18, 2017, 10:01am UTC](https://discuss.elastic.co/t/date-histogram-problem/71969/1 "2017-01-18T10:01:57Z")

</div>

Hello everyone,

I'm a beginner on ELK, Logstash and Kibana so sorry in advance if i make mistakes in my explanation !  
So, to explain, I configure Logstash to read my kannel logs and send some datas from them to my ELK, to finally centralize and analyze them on Kibana.  
To understand better, there is the pattern of my datas :

 ![](https://us1.discourse-cdn.com/elastic/original/2X/1/1261e0dccf5a047b2bb7e563cc00229b1a1264e2.png)

The problem is that I want to do a line chart with a date histogram with the sent\_date field to see the count of my instances hourly, but when I did it, no point and no line is visible on the chart. However, the data table tells me there are some values as you can see below :

 ![](https://us1.discourse-cdn.com/elastic/original/2X/d/d3f905f8a2cd8eb7a4337ec3999ee3d4e9ddb880.png)

So I'm asking for help to you ! I don't understand why this doesn't work.

Thanks !

PS : Sorry for my english, I'm french

---

<div class="post-metadata">

### Author: ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)
#### Post date: [January 18, 2017, 5:01pm UTC](https://discuss.elastic.co/t/date-histogram-problem/71969/2 "2017-01-18T17:01:17Z")

</div>

Hi Jeremy,

I see from your field list that you have 2 date data type fields, `@timestamp` and `sent_date`. Which one of those did you select when you created your `kannel-logs-test-01` index pattern?

If you go back to Management, Index Patterns, and click on your `kannel-logs-test-01` index pattern name near the top left if it's not already selected.  
Then you will see the field list for that index pattern. There's a little clock next to the default timestamp;

 ![](https://us1.discourse-cdn.com/elastic/original/2X/f/f4bf037163c824cf82812b89089d034e9675ab32.png)

If it's on `@timestamp` you might want to delete that index pattern and re-create it and select `sent_date` instead.

I think what you're doing should work even when you selected `@timestamp` as your time field name, but there's an open bug; [https://github.com/elastic/kibana/issues/5707](https://github.com/elastic/kibana/issues/5707)

Regards,  
Lee

---

<div class="post-metadata">

### Author: ![Jeremy\_Cugmas](https://avatars.discourse-cdn.com/v4/letter/j/a88e4f/32.png) [@Jeremy\_Cugmas](https://discuss.elastic.co/u/Jeremy_Cugmas)
#### Post date: [January 19, 2017, 8:38am UTC](https://discuss.elastic.co/t/date-histogram-problem/71969/3 "2017-01-19T08:38:31Z")

</div>

To do my chart I want to use the sent\_date field..  
I don't see what you mean when you say which one I choose when I created the index pattern, but there is my logstash configuration to read my logs and store data to my ELK :

filter {  
multiline {  
pattern =\> "^%{TIMESTAMP\_ISO8601} "  
negate =\> true  
what =\> "previous"  
}  
grok {  
match =\> {  
"message"=\>"%{TIMESTAMP\_ISO8601:timestamp} %{GREEDYDATA:kind} [SMSC:%{DATA:smsc}] [SVC:%{DATA:svc}] [ACT:%{DATA:account}] [BINF:%{DATA:binf}] [FID:%{DATA:fid}] [META:%{DATA:meta}] [from:%{GREEDYDATA:from}] [to:%{GREEDYDATA:to}] [flags:%{INT:flag1}:%{INT:flag2}:%{INT:flag3}:%{INT:flag4}:%{NUMBER:status:int}] [msg:%{NUMBER:msg\_length:int}:%{GREEDYDATA:msg}] [udh:0:]"  
}  
remove\_field =\> ["flag1","flag2","flag3","flag4","path","message"]  
}  
date {  
match =\> ["timestamp", "yyyy-MM-dd HH:mm:ss"]  
timezone =\> "Europe/Paris"  
target =\> "sent\_date"  
remove\_field =\> "timestamp"  
}  
}  
output {  
stdout{ codec =\> rubydebug}  
elasticsearch {  
"hosts" =\> "localhost:9200"  
"index" =\> "kannel-logs-test-01"  
}  
}

And about the little clock next to the field, there is no one next to my timestamp and my sent\_date field. There is no one as you can see below :

 ![](https://us1.discourse-cdn.com/elastic/original/2X/f/f0603c20c49483b0a2a723756753e07a81926980.png)

EDIT : I find out my error, when I created my index pattern, I have unchecked "Index contains time-based events  
" so that's why I wasn't able to do some date histogram !

Thanks for your help !

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 16, 2017, 8:38am UTC](https://discuss.elastic.co/t/date-histogram-problem/71969/4 "2017-02-16T08:38:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
