# Date range query returns no hits

**URL:** <https://discuss.elastic.co/t/date-range-query-returns-no-hits/293134>\
**Category:** Kibana\
**Created:** [December 29, 2021, 2:57pm UTC](https://discuss.elastic.co/t/date-range-query-returns-no-hits/293134 "2021-12-29T14:57:11Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![knwosu](https://avatars.discourse-cdn.com/v4/letter/k/4491bb/32.png) [@knwosu](https://discuss.elastic.co/u/knwosu)\
**Post date:** [December 29, 2021, 2:57pm UTC](https://discuss.elastic.co/t/date-range-query-returns-no-hits/293134/1 "2021-12-29T14:57:11Z")

</div>

I am trying to get all the hits from a specific index over the past 24 hours. I entered the following command into the kibana dev console, but no hits are being returned.

```auto
GET /my-index/_search
{
  "query": {
    "range": {
      "@timestamp": {
        "gte": "now-1d/d"
      }
    }
  }
}

```

I know the index is healthy, because its "Docs count" in the Index Management tab is increasing. Also, other GET commands that don't specify a date range are able to return hits, but I suspect that it is older hits being returned. This date range issue only started a few days ago, this index was acting total normal before now. I would also like to note that no recent (past 48 hours) hits are being for the index pattern on the kibana discover tab as well. Does any know how I can fix this issue? I would appreciate any and all help.

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [December 29, 2021, 3:41pm UTC](https://discuss.elastic.co/t/date-range-query-returns-no-hits/293134/2 "2021-12-29T15:41:36Z")

</div>

For troubleshooting purposes I would run the below and it will return the latest records timestamp just to compare if it will fall within your range.

```auto
GET /my-index/_search
{
  "size": 1,
  "query": {
    "match_all": {}
  },
  "sort": [
    {
      "@timestamp": {
        "order": "desc"
      }
    }
  ],
  "_source": ["@timestamp"]
}

```

---

<div class="post-metadata">

**Author:** ![knwosu](https://avatars.discourse-cdn.com/v4/letter/k/4491bb/32.png) [@knwosu](https://discuss.elastic.co/u/knwosu)\
**Post date:** [December 29, 2021, 3:59pm UTC](https://discuss.elastic.co/t/date-range-query-returns-no-hits/293134/3 "2021-12-29T15:59:00Z")

</div>

Hi Aaron,

hmm, I ran the command and the timestamp of the record is `2021-12-27T14:14:17.292Z` (Eastern Standard Time I presume). So I guess my index isn't actually getting anymore hits, which is weird because the index health is showing as "green" and the "Docs count" and "Storage size" is increasing at a steady pace, which I took as meaning that records are being added to the index. Would anyone happen to know the meaning behind this disparity?

Thanks

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [December 29, 2021, 4:26pm UTC](https://discuss.elastic.co/t/date-range-query-returns-no-hits/293134/4 "2021-12-29T16:26:58Z")

</div>

Guess it's possible that the index is receiving new records that don't have an `@timestamp` field for whatever reason.

I would just your source of what's feeding you the data. If it's Logstash or Beats then check those logs to see if there are any warnings.

---

<div class="post-metadata">

**Author:** ![knwosu](https://avatars.discourse-cdn.com/v4/letter/k/4491bb/32.png) [@knwosu](https://discuss.elastic.co/u/knwosu)\
**Post date:** [December 29, 2021, 4:42pm UTC](https://discuss.elastic.co/t/date-range-query-returns-no-hits/293134/5 "2021-12-29T16:42:51Z")

</div>

I've taken a look at our Logstash logs, and I'm seeing a bunch of these warnings for my index  
`elasticsearch - Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"my-index", :routing=>nil, :_type=>"_doc"}, #<LogStash::Event:0xcfb514b>], :response=>{"index"=>{"_index"=>"my-index", "_type"=>"_doc", "_id"=>"6s4GB34B21stRv-of0ss", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"Limit of total fields [1000] has been exceeded"}}}}`

So it appears that the record that induced this warning has over 1000 fields. My index should actually have ~300 fields, so I don't know where these extra fields are coming from. Are random fields being added to index hits a known problem?

---

<div class="post-metadata">

**Author:** ![knwosu](https://avatars.discourse-cdn.com/v4/letter/k/4491bb/32.png) [@knwosu](https://discuss.elastic.co/u/knwosu)\
**Post date:** [December 29, 2021, 5:59pm UTC](https://discuss.elastic.co/t/date-range-query-returns-no-hits/293134/6 "2021-12-29T17:59:55Z")

</div>

To see the number of fields that my index has, I ran `GET /my-index/_mapping` and did a ctrl-f for the word "type", which returned 984 results. There seems to have been a dynamic field blowup for whatever reason. I have now turned off dynamic mapping for my index, but my GET date range queries still aren't returning new records. Should I have does something else after turning off dynamic mapping?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 26, 2022, 6:00pm UTC](https://discuss.elastic.co/t/date-range-query-returns-no-hits/293134/7 "2022-01-26T18:00:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.