Inflated record count in when viewed in Kibana line chart

Elastic Stack Elasticsearch
1

I load 1 day of data, looks good. If I load the data for the next date, new timestamp, I am getting an sum of my values.

chart.jpg1174×845 71.4 KB

Example:

membership type A
2016-02-04 : count = 13,694
2016-02-04 : count = 6857

Why am I getting accumulated values? Shouldn't the count be specific to the day/date?
Here is a screen shot from KIbana.

Also, Why do I have more data the day before? Twice the records the day before?

2

If you set the interval to "Auto" you will get a more detailed view. Could it be that it is related to a time zone issue and all entries to Kibana appear to belong to the same day?

3

I can look into that. But I see something strange.

I deleted all the data on Feb 4th, today on the 5th, 1 of my data points is for Feb 1st?
How did that happen? Do I need to flush or something?

4

Why not explore and inspect the data in the Discover view instead to get a better understanding for the distribution of timestamps etc?

5

It could be TZ differences.

6

Changing the interval does not help.
I decided to delete everything and start fresh.

My day 1 is now inflated. but my next two days look good.

The ubuntu server elastic is running on had a bad date, it was 5 hours ahead.
Still not sure about this yet.

7

I reset my timezone, I guess we will see what happens tomorrow.

Today I have 3 data points.
The 1st is inflated the but the next 2 look normal.

8

How can a differerence in time zones affect this?
Would'nt each entry be in the same time zone? I only have 1 server loading data into elasticsearch.

9

If you're using a time range that doesn't contain all the data you think it should.