Kibana 7.4.0 date_nanos discover view surrounding documents broken

Elastic Stack Kibana
1

In discover view, I click view surrounding document: I can see the document I clicked on, but nothing around it. I believe this is related to date_nanos field type in kibana

Getting the error on the right pane as shown below:

Request to Elasticsearch failed: {
"error": {
"root_cause": [{
"type": "illegal_argument_exception",
"reason": "Failed to parse search_after value for field SourceTime."
}, {
"type": "illegal_argument_exception",
"reason": "Failed to parse search_after value for field SourceTime."
}, {
"type": "illegal_argument_exception",
"reason": "Failed to parse search_after value for field SourceTime."
}, {
"type": "illegal_argument_exception",
"reason": "Failed to parse search_after value for field SourceTime."
}, {
"type": "illegal_argument_exception",
"reason": "Failed to parse search_after value for field SourceTime."
}, {
"type": "illegal_argument_exception",
"reason": "Failed to parse search_after value for field SourceTime."
}, {
"type": "illegal_argument_exception",
"reason": "Failed to parse search_after value for field SourceTime."
}
],
"type": "search_phase_execution_exception",
"reason": "all shards failed",
"phase": "query",
"grouped": true,
"failed_shards": [{
"shard": 0,
"index": "someindex-000001",
"node": "cRSDEuywTT-6J9sR39_cMQ",
"reason": {
"type": "illegal_argument_exception",
"reason": "Failed to parse search_after value for field SourceTime.",
"caused_by": {
"type": "number_format_exception",
"reason": "For input string: "1571512375601432-07""
}
}
}, {
"shard": 0,
"index": "someindex2-000001",
"node": "cRSDEuywTT-6J9sR39_cMQ",
"reason": {
"type": "illegal_argument_exception",
"reason": "Failed to parse search_after value for field SourceTime.",
"caused_by": {
"type": "number_format_exception",
"reason": "For input string: "1571512375601432-07""
}
}
}, {
"shard": 0,
"index": "someindex3-000002",
"node": "cRSDEuywTT-6J9sR39_cMQ",
"reason": {
"type": "illegal_argument_exception",
"reason": "Failed to parse search_after value for field SourceTime.",
"caused_by": {
"type": "number_format_exception",
"reason": "For input string: "1571512375601432-07""
}
}
}, {
"shard": 0,
"index": "someindex4-000001",
"node": "cRSDEuywTT-6J9sR39_cMQ",
"reason": {
"type": "illegal_argument_exception",
"reason": "Failed to parse search_after value for field SourceTime.",
"caused_by": {
"type": "number_format_exception",
"reason": "For input string: "1571512375601432-07""
}
}
}, {
"shard": 0,
"index": "someindex6-000002",
"node": "cRSDEuywTT-6J9sR39_cMQ",
"reason": {
"type": "illegal_argument_exception",
"reason": "Failed to parse search_after value for field SourceTime.",
"caused_by": {
"type": "number_format_exception",
"reason": "For input string: "1571512375601432-07""
}
}
}, {
"shard": 0,
"index": "someindex5-000001",
"node": "cRSDEuywTT-6J9sR39_cMQ",
"reason": {
"type": "illegal_argument_exception",
"reason": "Failed to parse search_after value for field SourceTime.",
"caused_by": {
"type": "number_format_exception",
"reason": "For input string: "1571512375601432-07""
}
}
}, {
"shard": 0,
"index": "someindex7-000002",
"node": "cRSDEuywTT-6J9sR39_cMQ",
"reason": {
"type": "illegal_argument_exception",
"reason": "Failed to parse search_after value for field SourceTime.",
"caused_by": {
"type": "number_format_exception",
"reason": "For input string: "1571512375601432-07""
}
}
}
],
"caused_by": {
"type": "illegal_argument_exception",
"reason": "Failed to parse search_after value for field SourceTime.",
"caused_by": {
"type": "illegal_argument_exception",
"reason": "Failed to parse search_after value for field SourceTime.",
"caused_by": {
"type": "number_format_exception",
"reason": "For input string: "1571512375601432-07""
}
}
}
},
"status": 400
}

A new notification appears

2

Hi, thanks for reporting this.
Could you provide a raw JSON ES document? Would be interested how the date_nanos timestamp was stored. Many thx!

3

{
"_index": "someindex-000002",
"_type": "_doc",
"_id": "5JRX-m0Bc5kyokWuOSYf",
"_version": 1,
"_score": null,
"_source": {
"LogServerTime": "2019-10-23T13:38:02.520874-07:00",
"SourceTime": "2019-10-23T13:38:02.696874-07:00",
"Microseconds": 1892782937874,
"ThreadId": 1,
"Message": "TID 0x0001 Exiting LogMessagesCallback after 0 ms",
"DeviceName": "RS-AMTEST-GUI.Nova.OperatorInterface.",
"TypeName": "EntryExit",
"ModuleName": "OIClient",
"FunctionName": "STARTUP",
"FormatName": "Format1",
"ToolName": "RV-AMTEST",
"PackageType": "rcp",
"FunctionId": 1,
"DeviceId": 15,
"FormatId": 1
},
"fields": {
"LogServerTime": [
"2019-10-23T20:38:02.520874Z"
],
"SourceTime": [
"2019-10-23T20:38:02.696874Z"
]
},
"sort": [
1571863082696874000,
46354198
],
"$$_isAnchor": true
}

4

@matw
Also what may be related to this problem is my colleagues in India (time zone and OS regional settings) can see everything in Kibana if timestamp is in standard date format. However, discover view shows no documents if we used date_nanos field. Looks date_nanos_regional_problem like the date/time picker somehow resolves to year 1945, which is outside of epoch. They tried using relative and absolute date selection - still can't see any documents.

5

Thanks for you feedback, I'll investigate the issue

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.