Date Histograms - Multiple date fields and the global date field

Elastic Stack Kibana
1

So when you create a new index you have to set a default datefield. This gets used for the global time ranges on queries.
So what do you do if you have multiple date fields and you want to switch which field gets used depending on what you want info on? There doesn't appear to be an easy way, if at all possible, to change what that default is without recreating the index pattern.

For example I am pulling some data from Salesforce. Some types of data have a CreatedDate, some do not. Because of this I have to have @Timestamp as the global date field. @Timestamp exists on every record and is basically an update date of the salesforce record. If I didn't do it this way simple searches in the Discover tab will exclude data that did not have a CreatedDate.

But now if I want to do a date histogram visualization on the subset of data with a CreatedDate I get weird results. The date histogram buckets are being built off of CreatedDate, but the overall X Axis is being controlled by the global date range at the top. This means I get some odd visualizations like below. The global date range (@Timestamp) is set to last 24 hours, but it shows results all the way back to 2015. I had records updated yesterday, but they were created in SF a long time ago.

The closest solution I have found is to force the CreatedDate to a specific range in the query itself. To be safe I also have to open up the global date range up top too.
This solution isn't perfect though. It looks like it may be doing some odd things when trying to adjust for time zone differences. Notice how it pulls results from the 4th, even though by query says to start on the 5th.

Pasted image1401×408 29 KB

You also can't click and drag the visualization to drill down and change the date range.

So is there an easier or better way to do this? Ideally the global date range would automatically adjust to whatever field I have specified in the X-axis date histogram bucket.

2

There isn't a great solution for this, but there are a couple of workarounds you can try.

If you want to stick with a single index pattern, you could try the workaround described here: https://github.com/elastic/kibana/issues/5326#issuecomment-154111082. Basically make the time range for the time picker really big and use the filter bar to drill down on the date range you'd like in your "other" date field. That won't allow you to drill down by clicking or dragging on the chart though.

You could also create an alias for you index pattern in Elasticsearch and add that as an additional index pattern in Kibana, with the CreatedDate set as the time field. You could use this index pattern for creating any visualizations that need to be based on CreatedDate. Dashboards support visualizations from multiple index patterns, and this would retain the click/drag drill down, so this might be a better option for you.