Elastic Search for a date filter is not working. If I give my filter as "logintime is 2024-01-25" , I was expecting it would bring all data with login time 2024-01-25 but it also bring data for login time = 2024-01-24 as well. Please find the screenshot, can someone please help me with this, I do not want to use "is between" since i am using this url for my drill down url and I am unable to get this filter in my lens.
Hi @Divya_Kd Welcome to the community!
That is because Elasticsearch stores all dates in UTC but Kibana Display them Local to Kibana ....
In general this make working with Discover make sense in Local Time
BUT When you use a Filter with a Date/Time, though, that date you entered is treated as UTC...
Time Picker which is what is used mostly with discover is in Local Time.
See Here ... Note I looked at the JSON
Time Picker Local
If you want to see it all the same....
Kibana -> Stack Management -> Advanced Settings -> Time Zone
Set the Kibana Time Zone to UTC
Hi @stephenb Thank you for your response. Is there any way in kibana to add a day value to single click url in drilldown of kibana visualization? query:'{{date event.value "YYYY-MM-DD"}} +1d'
Also I am trying to get using login time and not using timestamp but still i guess there is issue. Weird part is the count I am getting in tsvb visualization doesnt consider this utc but discover does. So because of that my drill down shows a different count thatn the visualization. Currently I am looking for a way to send a range of date for Feb8,2024, I want to send gte as 2024-02-08 and lte and 2024-02-09 which brings proper count. But unfortunately I am unable to add a day to {{date even.value "YYYY-MM-DD"}}
Apologies I am not sure I am following...
What version of Kibana?
Your trying to do a drill down with a URL but modify the date in the URL.... can you show... but in short I don't think you can do date math in the URL
There might be another way, but I'm not sure. Perhaps, you could create a runtime field that adds a date to the field... or perhaps you could do it in Lens, not TSVB?
Show more, please...
So, @stephenb I am using Kibana version 7.17.7 and in my dashboard I am using a lens to show the number of users logged in my login time, and login status. In the drill down I am creating a single click URL to go to discover by passing login date as filter for discover and login status as another filter using {{date even.value}} and {{even.points[1].value}} . I would like to pass a gte and lte instead of filter using one single date. But as you mentioned I cannot do math in url is there any other way?
can i get these filter values in my url for to pass in my url?
Actually you should be able to...
Go to discover and set up the filters the way you want... Using the fields / filter you want..
Copy The Discover URL and Then use that URL as the template for the drill down URL and substitute the correct parameters... I think all the fields in docs are available... or maybe only the fields you split / aggregate by....
You can try filters or KQL then fill in the event data
I have done that in the past and it worked... If I am understanding correctly..
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.