We are inserting each record in elasticSearch index(test_elastalert1) with having two time fields(from python code) as below
"time" : datetime.utcnow().isoformat()+'Z',
"local_time" : datetime.now()
Below are the corresponding values for record in index,test_elastalert1:
We have inserted multiple records in index and able to see the total count when I run match_all DSL query. But the count is not getting displayed correctly when I search last one hr. whereas if I select last 12hrs the data is displaying with local time stamp. I tried with local_time and time in “date Histogram” .