We are inserting each record in elasticSearch index(test_elastalert1) with having two time fields(from python code) as below
"time" : datetime.utcnow().isoformat()+'Z',
"local_time" : datetime.now()
Below are the corresponding values for record in index,test_elastalert1:
"local_time":"2019-02-15T13:36:43.248000",
"time":"2019-02-15T19:36:43.248000Z"
We have inserted multiple records in index and able to see the total count when I run match_all DSL query. But the count is not getting displayed correctly when I search last one hr. whereas if I select last 12hrs the data is displaying with local time stamp. I tried with local_time and time in “date Histogram” .