I have a set of monthly going back a couple of years. When using Kibana in discovery, searching back a few months, I am seeing the histogram is showing the proper hits, but in the table below, the data for some of the indices is missing. What I am, for instance, if I am searching for data from Jan 3 2016 until March 15 2016, I am seeing from my browser an _msearch request, for each month (Jan, Feb and March), which is perfect.
However the request for Feb is always leaving with a "search_tyle" count and size set to zero, like this:
The search result size in total is 240 documents and I have set the discover:sampleSize to it's max of 9,999 with no change in behavior.
If I repeat this on data in a daily index, I cannot seem to make this happen. I am going to start to debug the Kibana code to see how it builds the search requests and see if it thinks there is something different with the index, but I am wondering if anyone else has seen this.
Can you try changing your time range to just Feb and see if Kibana shows you results in that case?
If that works, try Feb and March, and try Jan and Feb (so that month and later, and that month and earlier) and see if both of those work.
The other thing you could do, if you haven't already, is to query the index in Elasticsearch directly and see that it returns the data you expect (or count).
Searching across 2 months, is hit and miss, I see some cases where the request for data from 2 indices have "size:500" and some where the "size:0".
the histogram still counts and shows the proper (or expected) number of events though with each case. And yes, querying the index itself does return properly. Something seems to tip the client to request size:0 at some point.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.