Kibana 4.3.1 discovery across multiple monthly indices - sets size=0 / search_type='count'

Elastic Stack Kibana
1

Hi,
Running, ES 2.1.1 and Kibana 4.3.1

I have a set of monthly going back a couple of years. When using Kibana in discovery, searching back a few months, I am seeing the histogram is showing the proper hits, but in the table below, the data for some of the indices is missing. What I am, for instance, if I am searching for data from Jan 3 2016 until March 15 2016, I am seeing from my browser an _msearch request, for each month (Jan, Feb and March), which is perfect.

However the request for Feb is always leaving with a "search_tyle" count and size set to zero, like this:

{"index":["events2-cpqa1-2016-02"],"search_type":"count","ignore_unavailable":true}
{"size":0,"sort":[{"EventTime":

compared to Jan and March:

{"index":["events2-cpqa1-2016-01"],"ignore_unavailable":true}
{"size":500,"sort":[{"EventTime":  ....

The search result size in total is 240 documents and I have set the discover:sampleSize to it's max of 9,999 with no change in behavior.

If I repeat this on data in a daily index, I cannot seem to make this happen. I am going to start to debug the Kibana code to see how it builds the search requests and see if it thinks there is something different with the index, but I am wondering if anyone else has seen this.

2

Hi Phil,

Can you try changing your time range to just Feb and see if Kibana shows you results in that case?

If that works, try Feb and March, and try Jan and Feb (so that month and later, and that month and earlier) and see if both of those work.

The other thing you could do, if you haven't already, is to query the index in Elasticsearch directly and see that it returns the data you expect (or count).

Thanks,
Lee

3

Thanks Lee for some thoughts...

Searching across 2 months, is hit and miss, I see some cases where the request for data from 2 indices have "size:500" and some where the "size:0".

the histogram still counts and shows the proper (or expected) number of events though with each case. And yes, querying the index itself does return properly. Something seems to tip the client to request size:0 at some point.

4

Sounds like a bug, can you please file an issue on github?

5

Can you check to see if the bug exists on a more recent version? At least on 4.3.3, which is the latest release on the 4.3 line.

6

@spalger Sure I can, and yeah @Court that is reasonable, so I will test with 4.3.3 as well before I open any tickets.

7

I repro'd the issue with Kibana 4.3.3 and so created https://github.com/elastic/kibana/issues/6697

I will continue to research the javascript for any signs of an issue.

Thanks