# Documents not showing up in Discover, but are showing up in queries in Dev Tools

**URL:** https://discuss.elastic.co/t/documents-not-showing-up-in-discover-but-are-showing-up-in-queries-in-dev-tools/311451
**Category:** Kibana
**Created:** [August 4, 2022, 4:48pm UTC](https://discuss.elastic.co/t/documents-not-showing-up-in-discover-but-are-showing-up-in-queries-in-dev-tools/311451 "2022-08-04T16:48:00Z")
**Posts on this page:** 12
**Page:** 1

<div class="post-metadata">

### Author: ![Arjun\_Meena](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arjun_meena/32/109270_2.png) [@Arjun\_Meena](https://discuss.elastic.co/u/Arjun_Meena)
#### Post date: [August 4, 2022, 4:48pm UTC](https://discuss.elastic.co/t/documents-not-showing-up-in-discover-but-are-showing-up-in-queries-in-dev-tools/311451/1 "2022-08-04T16:48:01Z")

</div>

I have an index **spoms-audit-2022.08.04** in which there are 4 documents. When I search them from the dev console, i am able to see all the documents.  
Below is the search query:  
 ![Query Photo](https://us1.discourse-cdn.com/elastic/original/3X/f/3/f39b2e6ca75ac3b646e5f0184ad58b9050910dd8.jpeg)

These are the results I get back:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/f/ffe9ccc74b8cfb250f6f3608de65e06c244df2b7.png)

As we can see that I have 4 documents in total in this index pattern.

When I go to the discover tab and then in the index pattern **spoms-audit** \*, I am not able to see any logs.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/0/a0473dabafd64fab9c0cf25d66a4839454b40faf.png)

The time range I have set in Discover tab far exceeds the time the logs were generated. Yet I am not able to see any logs here..

Any help would be appreciated. Thanks!

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [August 4, 2022, 4:58pm UTC](https://discuss.elastic.co/t/documents-not-showing-up-in-discover-but-are-showing-up-in-queries-in-dev-tools/311451/2 "2022-08-04T16:58:29Z")

</div>

Hi @Arjun_Meena Welcome to the Commuity.

Did you set the `@timestamp` field as the time field in the index pattern when you set it up?

What version are you on?

---

<div class="post-metadata">

### Author: ![Arjun\_Meena](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arjun_meena/32/109270_2.png) [@Arjun\_Meena](https://discuss.elastic.co/u/Arjun_Meena)
#### Post date: [August 4, 2022, 4:58pm UTC](https://discuss.elastic.co/t/documents-not-showing-up-in-discover-but-are-showing-up-in-queries-in-dev-tools/311451/3 "2022-08-04T16:58:46Z")

</div>

Yes I did.

Here is the screenshot

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/5/955cf164b67b0c44ef9ef2c1f8b18281bc34c89e.png)

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [August 4, 2022, 4:59pm UTC](https://discuss.elastic.co/t/documents-not-showing-up-in-discover-but-are-showing-up-in-queries-in-dev-tools/311451/4 "2022-08-04T16:59:44Z")

</div>

What version are you on?

Do a Shift Reload of the Discover page.

---

<div class="post-metadata">

### Author: ![Arjun\_Meena](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arjun_meena/32/109270_2.png) [@Arjun\_Meena](https://discuss.elastic.co/u/Arjun_Meena)
#### Post date: [August 4, 2022, 5:01pm UTC](https://discuss.elastic.co/t/documents-not-showing-up-in-discover-but-are-showing-up-in-queries-in-dev-tools/311451/5 "2022-08-04T17:01:11Z")

</div>

Logstash is 8.3 and Elasticsearch is 8.2

---

<div class="post-metadata">

### Author: ![Arjun\_Meena](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arjun_meena/32/109270_2.png) [@Arjun\_Meena](https://discuss.elastic.co/u/Arjun_Meena)
#### Post date: [August 4, 2022, 5:02pm UTC](https://discuss.elastic.co/t/documents-not-showing-up-in-discover-but-are-showing-up-in-queries-in-dev-tools/311451/6 "2022-08-04T17:02:04Z")

</div>

I did Shift Reload, but still see nothing ☹

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [August 4, 2022, 5:04pm UTC](https://discuss.elastic.co/t/documents-not-showing-up-in-discover-but-are-showing-up-in-queries-in-dev-tools/311451/7 "2022-08-04T17:04:23Z")

</div>

🙂 What timezone are you in?

Try this set discover to a future time say a day in the future

 ![Screen Shot 2022-08-04 at 10.03.04 AM](https://us1.discourse-cdn.com/elastic/original/3X/9/7/97b25d527c6dc91a2786f111aefb50256d44a490.png)

Pretty sure you are loading your time with out timezone so it is in the future.

Also when you show text please paste as text not screen shot... some people can not see the images and the can not be searched or debug... example I could not cut-paste your date

The Future 🙂

 ![Screen Shot 2022-08-04 at 10.06.42 AM](https://us1.discourse-cdn.com/elastic/original/3X/e/f/ef5766d50207dcdce19d39b471aad25608b4fbfb.png)

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [August 4, 2022, 5:16pm UTC](https://discuss.elastic.co/t/documents-not-showing-up-in-discover-but-are-showing-up-in-queries-in-dev-tools/311451/9 "2022-08-04T17:16:08Z")

</div>

Simple / Most Likely your logs are in local / IST but when you are parsing with logstash you are not setting / accounting for the IST timezone.

If no timezone is provided then Logastash / Elastic assume UTC... that is what is happening you are "Ahead" of UCT

Where ever you are processing the date on ingest you need to account for timezone.

---

<div class="post-metadata">

### Author: ![Arjun\_Meena](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arjun_meena/32/109270_2.png) [@Arjun\_Meena](https://discuss.elastic.co/u/Arjun_Meena)
#### Post date: [August 4, 2022, 5:20pm UTC](https://discuss.elastic.co/t/documents-not-showing-up-in-discover-but-are-showing-up-in-queries-in-dev-tools/311451/10 "2022-08-04T17:20:29Z")

</div>

I'm updating the timestamp using the logstash filter, Is there any way I can tell it this time is in IST?  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/f/7f1ffc02d96e6ef3e93cc62ca90c1dea7cbe4632.png)

@stephenb I figured out the setting that I need to change... Thanks a lot!! We were stuck on this for about a week now..Thanks a lot for your help. You rock 🙂 🤩

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [August 4, 2022, 5:33pm UTC](https://discuss.elastic.co/t/documents-not-showing-up-in-discover-but-are-showing-up-in-queries-in-dev-tools/311451/11 "2022-08-04T17:33:25Z")

</div>

@Arjun_Meena  
OK good community is to not post screen shot... and if you do have a solution you should post that for others to benefit from.. you say you solved it but did not show.. please do 🙂 so the next person can learn from you!

---

<div class="post-metadata">

### Author: ![Arjun\_Meena](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arjun_meena/32/109270_2.png) [@Arjun\_Meena](https://discuss.elastic.co/u/Arjun_Meena)
#### Post date: [August 4, 2022, 9:19pm UTC](https://discuss.elastic.co/t/documents-not-showing-up-in-discover-but-are-showing-up-in-queries-in-dev-tools/311451/12 "2022-08-04T21:19:07Z")

</div>

The timestamp of my logs was in the local timezone (IST). I was picking the timestamp from my logs and overwriting it to the @timestamp field using logstash date filter plugin. I didn't specify any timezone setting there, so elasticsearch is taking that @timestamp as UTC and converting it to our local time zone, making them 5:30 hours ahead of their actual time.  
So a log with an original timestamp of August 4th, 2022 20:40:58.364 (IST) would be shown in the discover tab as August 5th, 2022 02:10:58.364.  
All I had to do to fix this was basically specify the timezone of the logs in the date filter plugin, so the elasticsearch would know that the logs timstamp are already in the IST timezone, and it doesn't need to add any offset.

Below is the working logstash config:

```auto
  #Update the timestamp with the timestamp present in the log
    date {
        match => ["timestamp", "dd-MM-yyyy'T'HH:mm:ss.SSS"]
        target => "@timestamp"
        timezone => "Asia/Kolkata"
    }   

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 1, 2022, 9:19pm UTC](https://discuss.elastic.co/t/documents-not-showing-up-in-discover-but-are-showing-up-in-queries-in-dev-tools/311451/13 "2022-09-01T21:19:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
