Inconsistencies in query vs display in Discover

(Mike Conner) #1

I'm using kibana 6.6.0 and have stored a doc with study date as:
...
"studyDate_datetime": "2011-05-30T21:11:15.000Z"
...

When I query for this in Discover as: studyDate_datetime: 2011-05-30
It matches, and displays as May 30th 2011, 16:11:15.000.

However, it does not match studyDate_datetime: 2011-05-30T16.
Apparently, while kibana displays dates according to the browser timezone, it does not query according to the browser timezone (when it is not specified), but instead uses UTC. This seems inconsistent. Is there some way to change this?

I've found that I can explicitly define the offset in the query, and this works properly:
studyDate_datetime: 2011-05-30T16-0500

Related to this, I modified the Date Format to be MMMM Do YYYY, HH:mm:ss.SSSZZ, so at least it is clear what offset is being displayed, but that's somewhat clunky, and has an unfortunate result, since this format is apparently also used to display filters: I enter a filter value of 2011-05-30T21. Consistent with the query behavior, it filters on 2011-05-30T21Z, and returns a result. But it displays the filter as studyDate_datetime: May 30th 2011, 21:00:00.000-0500:
image
This seems like a bug. It is actually filtering on ... 21Z, not 21-0500. Again, at least if you specify the offset explicitly, it works correctly. (Also, the inclusion of the minute, second, and millisecond in the filter message is inaccurate, since it is only filtering to the hour level.)

(Thomas Neirynck) #2

hi @mconner

you can change the default time-zone setting in dateFormat:tz advanced setting of Kibana. https://www.elastic.co/guide/en/kibana/current/advanced-options.html

The default is indeed the browser's timezone.

(Mike Conner) #3

@thomasneirynck, I understand that I can change the timezone used for display, but that's not what I'm asking. I want to know if there's some way to get Kibana to use whatever time zone is set (e.g. the browser) when it performs queries if I don't explicitly specify one by appending an offset (e.g.: "-0500"). Otherwise, it is inconsistent between what it requests and what it displays (unless I set dateFormat:tzto UTC). More concisely: queries should default to dateFormat:tzinstead of UTC.