# Kibana 4.3.1 discovery across multiple monthly indices - sets size=0 / search\_type='count'

**URL:** <https://discuss.elastic.co/t/kibana-4-3-1-discovery-across-multiple-monthly-indices-sets-size-0-search-type-count/45584>\
**Category:** Kibana\
**Created:** [March 28, 2016, 11:56am UTC](https://discuss.elastic.co/t/kibana-4-3-1-discovery-across-multiple-monthly-indices-sets-size-0-search-type-count/45584 "2016-03-28T11:56:45Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Phil\_Scala](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/phil_scala/32/41939_2.png) [@Phil\_Scala](https://discuss.elastic.co/u/Phil_Scala)\
**Post date:** [March 28, 2016, 11:56am UTC](https://discuss.elastic.co/t/kibana-4-3-1-discovery-across-multiple-monthly-indices-sets-size-0-search-type-count/45584/1 "2016-03-28T11:56:45Z")

</div>

Hi,  
Running, ES 2.1.1 and Kibana 4.3.1

I have a set of monthly going back a couple of years. When using Kibana in discovery, searching back a few months, I am seeing the histogram is showing the proper hits, but in the table below, the data for some of the indices is missing. What I am, for instance, if I am searching for data from Jan 3 2016 until March 15 2016, I am seeing from my browser an \_msearch request, for each month (Jan, Feb and March), which is perfect.

However the request for **Feb** is always leaving with a "search\_tyle" count and size set to zero, like this:

```
{"index":["events2-cpqa1-2016-02"],"search_type":"count","ignore_unavailable":true}
{"size":0,"sort":[{"EventTime":

```

compared to Jan and March:

```
{"index":["events2-cpqa1-2016-01"],"ignore_unavailable":true}
{"size":500,"sort":[{"EventTime": ....

```

The search result size in total is 240 documents and I have set the discover:sampleSize to it's max of 9,999 with no change in behavior.

If I repeat this on data in a daily index, I cannot seem to make this happen. I am going to start to debug the Kibana code to see how it builds the search requests and see if it thinks there is something different with the index, but I am wondering if anyone else has seen this.

---

<div class="post-metadata">

**Author:** ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)\
**Post date:** [March 28, 2016, 2:08pm UTC](https://discuss.elastic.co/t/kibana-4-3-1-discovery-across-multiple-monthly-indices-sets-size-0-search-type-count/45584/2 "2016-03-28T14:08:27Z")

</div>

Hi Phil,

Can you try changing your time range to just Feb and see if Kibana shows you results in that case?

If that works, try Feb and March, and try Jan and Feb (so that month and later, and that month and earlier) and see if both of those work.

The other thing you could do, if you haven't already, is to query the index in Elasticsearch directly and see that it returns the data you expect (or count).

Thanks,  
Lee

---

<div class="post-metadata">

**Author:** ![Phil\_Scala](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/phil_scala/32/41939_2.png) [@Phil\_Scala](https://discuss.elastic.co/u/Phil_Scala)\
**Post date:** [March 28, 2016, 5:33pm UTC](https://discuss.elastic.co/t/kibana-4-3-1-discovery-across-multiple-monthly-indices-sets-size-0-search-type-count/45584/3 "2016-03-28T17:33:38Z")

</div>

Thanks Lee for some thoughts...

Searching across 2 months, is hit and miss, I see some cases where the request for data from 2 indices have "size:500" and some where the "size:0".

the histogram still counts and shows the proper (or expected) number of events though with each case. And yes, querying the index itself does return properly. Something seems to tip the client to request size:0 at some point.

---

<div class="post-metadata">

**Author:** ![spalger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spalger/32/14092_2.png) [@spalger](https://discuss.elastic.co/u/spalger)\
**Post date:** [March 28, 2016, 5:56pm UTC](https://discuss.elastic.co/t/kibana-4-3-1-discovery-across-multiple-monthly-indices-sets-size-0-search-type-count/45584/4 "2016-03-28T17:56:53Z")

</div>

> [@Phil\_Scala](#):
>
> search result size in total is 240 documents

Sounds like a bug, can you please file an issue on github?

---

<div class="post-metadata">

**Author:** ![Court](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/court/32/6640_2.png) [@Court](https://discuss.elastic.co/u/Court)\
**Post date:** [March 28, 2016, 5:58pm UTC](https://discuss.elastic.co/t/kibana-4-3-1-discovery-across-multiple-monthly-indices-sets-size-0-search-type-count/45584/5 "2016-03-28T17:58:54Z")

</div>

Can you check to see if the bug exists on a more recent version? At least on 4.3.3, which is the latest release on the 4.3 line.

---

<div class="post-metadata">

**Author:** ![Phil\_Scala](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/phil_scala/32/41939_2.png) [@Phil\_Scala](https://discuss.elastic.co/u/Phil_Scala)\
**Post date:** [March 28, 2016, 7:01pm UTC](https://discuss.elastic.co/t/kibana-4-3-1-discovery-across-multiple-monthly-indices-sets-size-0-search-type-count/45584/6 "2016-03-28T19:01:00Z")

</div>

@spalger Sure I can, and yeah @Court that is reasonable, so I will test with 4.3.3 as well before I open any tickets.

---

<div class="post-metadata">

**Author:** ![Phil\_Scala](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/phil_scala/32/41939_2.png) [@Phil\_Scala](https://discuss.elastic.co/u/Phil_Scala)\
**Post date:** [March 29, 2016, 8:36pm UTC](https://discuss.elastic.co/t/kibana-4-3-1-discovery-across-multiple-monthly-indices-sets-size-0-search-type-count/45584/7 "2016-03-29T20:36:28Z")

</div>

I repro'd the issue with Kibana 4.3.3 and so created [https://github.com/elastic/kibana/issues/6697](https://github.com/elastic/kibana/issues/6697)

I will continue to research the javascript for any signs of an issue.

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:57pm UTC](https://discuss.elastic.co/t/kibana-4-3-1-discovery-across-multiple-monthly-indices-sets-size-0-search-type-count/45584/8 "2017-07-06T13:57:28Z")

</div>


