# Kibana (kibana-3.0.0 and master of today) dont' show records
**URL:** https://discuss.elastic.co/t/kibana-kibana-3-0-0-and-master-of-today-dont-show-records/16700
**Category:** Elasticsearch
**Created:** [March 30, 2014, 3:17pm UTC](https://discuss.elastic.co/t/kibana-kibana-3-0-0-and-master-of-today-dont-show-records/16700 "2014-03-30T15:17:57Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Israel\_Calvete](https://discuss.elastic.co/u/Israel_Calvete)
#### Post date: [March 30, 2014, 3:17pm UTC](https://discuss.elastic.co/t/kibana-kibana-3-0-0-and-master-of-today-dont-show-records/16700/1 "2014-03-30T15:17:57Z")
I'm using ES 1.1.0.
Index has been created with fluentd (plugin fluent-plugin-elasticsearch
version 0.3.0) with directive _logstash\_forma_t directive with value \*true \*to
be compatible with logstash.
Kibana don't show records.
With tcpump I can see requests/responses flow. All seems good but this
request don't get records.
_POST /logstash-2014.03.29/\_search HTTP/1.1_
_{"query":{"filtered":{"query":{"bool":{"should":[{"query\_string":{"query":"_"}}]}},"filter":{"bool":{"must":[{"range":{"@timestamp":{"from":1396103643779,"to":"now"}}}]}}}},"highlight":{"fields":{},"fragment\_size":2147483647,"pre\_tags":["@start-highlight@"],"post\_tags":["@end-highlight@"]},"size":500,"sort":[{"@timestamp":{"order":"desc"}},{"@timestamp":{"order":"desc"}}]}\*
With this data returns records.
_{"highlight":{"fields":{},"fragment\_size":2147483647,"pre\_tags":["@start-highlight@"],"post\_tags":["@end-highlight@"]},"size":500,"sort":[{"@timestamp":{"order":"desc"}},{"@timestamp":{"order":"desc"}}]}_
So the problems seems this.
_{"query":{"filtered":{"query":{"bool":{"should":[{"query\_string":{"query":"_"}}]}},"filter":{"bool":{"must":[{"range":{"@timestamp":{"from":1396103643779,"to":"now"}}}]}}}}}\*
In fact, this don't work neither.
_{"query":{"filtered":{"query":{"bool":{"should":[{"query\_string":{"query":"_"}}]}\*
In both cases response is ...
_{_
- "took": 5,\*
- "timed\_out": false,\*
- "\_shards": {\*
-
```
"total": 5,*
```
-
```
"successful": 5,*
```
-
```
"failed": 0*
```
- },\*
- "hits": {\*
-
```
"total": 0,*
```
-
```
"max_score": null,*
```
-
```
"hits": []*
```
- }\*
_}_
If send the POST /logstash-2014.03.29/\_search without data ES returns
records.
What's wrong?
Thanks.
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/0354e9ac-aa8a-4f20-935b-571747347078%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/0354e9ac-aa8a-4f20-935b-571747347078%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@Israel\_Calvete](https://discuss.elastic.co/u/Israel_Calvete)
#### Post date: [March 30, 2014, 4:20pm UTC](https://discuss.elastic.co/t/kibana-kibana-3-0-0-and-master-of-today-dont-show-records/16700/2 "2014-03-30T16:20:34Z")
Ok
I have a template...
_{_
-
```
"template" : "logstash*",*
```
-
```
"settings" : {*
```
-
```
"index.store.compress.stored" : "true",*
```
-
```
"index.cache.field.type" : "soft",*
```
-
```
"index.query.default_field" : "@message",*
```
-
```
},*
```
-
```
"mappings" : {*
```
-
```
"_default_" : {*
```
-
```
"_all" : {"enabled" : false},*
```
-
```
"_source": { "compress": true },*
```
-
```
"properties" : {*
```
-
```
"@fields" : {*
```
-
```
"type" : "object",*
```
-
```
"dynamic": true,*
```
-
```
"path": "full",*
```
-
```
"properties" : {*
```
-
```
"errnum" : { "type":
```
"integer"}\*
-
```
}*
```
-
```
},*
```
-
```
"@message": { "type": "string", "index":
```
"analyzed" },\*
-
```
"@source": { "type": "string", "index":
```
"not\_analyzed" },\*
-
```
"@source_host": { "type": "string",
```
"index": "not\_analyzed" },\*
-
```
"@source_path": { "type": "string",
```
"index": "not\_analyzed" },\*
-
```
"@tags": { "type": "string", "index":
```
"not\_analyzed" },\*
-
```
"@timestamp": { "type": "date", "index":
```
"not\_analyzed" },\*
-
```
"@type": { "type": "string", "index":
```
"not\_analyzed" }\*
-
```
}*
```
-
```
}*
```
-
```
}*
```
_}_
Without template works, but I don't know why.
On Sunday, March 30, 2014 5:17:57 PM UTC+2, Israel Calvete wrote:
> I'm using ES 1.1.0.
>
> Index has been created with fluentd (plugin fluent-plugin-elasticsearch
> version 0.3.0) with directive _logstash\_forma_t directive with value \*true
> \*to be compatible with logstash.
>
> Kibana don't show records.
>
> With tcpump I can see requests/responses flow. All seems good but this
> request don't get records.
>
> _POST /logstash-2014.03.29/\_search HTTP/1.1_
>
> _{"query":{"filtered":{"query":{"bool":{"should":[{"query\_string":{"query":"_"}}]}},"filter":{"bool":{"must":[{"range":{"@timestamp":{"from":1396103643779,"to":"now"}}}]}}}},"highlight":{"fields":{},"fragment\_size":2147483647,"pre\_tags":["@start-highlight@"],"post\_tags":["@end-highlight@"]},"size":500,"sort":[{"@timestamp":{"order":"desc"}},{"@timestamp":{"order":"desc"}}]}\*
>
> With this data returns records.
>
> _{"highlight":{"fields":{},"fragment\_size":2147483647,"pre\_tags":["@start-highlight@"],"post\_tags":["@end-highlight@"]},"size":500,"sort":[{"@timestamp":{"order":"desc"}},{"@timestamp":{"order":"desc"}}]}_
>
> So the problems seems this.
>
> _{"query":{"filtered":{"query":{"bool":{"should":[{"query\_string":{"query":"_"}}]}},"filter":{"bool":{"must":[{"range":{"@timestamp":{"from":1396103643779,"to":"now"}}}]}}}}}\*
>
> In fact, this don't work neither.
>
> _{"query":{"filtered":{"query":{"bool":{"should":[{"query\_string":{"query":"_"}}]}\*
>
> In both cases response is ...
>
> _{_
>
> - "took": 5,\*
> - "timed\_out": false,\*
> - "\_shards": {\*
> -
>
> ```
> "total": 5,*
>
> ```
>
> -
>
> ```
> "successful": 5,*
>
> ```
>
> -
>
> ```
> "failed": 0*
>
> ```
>
> - },\*
> - "hits": {\*
> -
>
> ```
> "total": 0,*
>
> ```
>
> -
>
> ```
> "max_score": null,*
>
> ```
>
> -
>
> ```
> "hits": []*
>
> ```
>
> - }\*
> _}_
>
> If send the POST /logstash-2014.03.29/\_search without data ES returns
> records.
>
> What's wrong?
>
> Thanks.
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/40daca97-39d7-4a50-bef8-757f68c14363%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/40daca97-39d7-4a50-bef8-757f68c14363%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@Israel\_Calvete](https://discuss.elastic.co/u/Israel_Calvete)
#### Post date: [March 30, 2014, 4:40pm UTC](https://discuss.elastic.co/t/kibana-kibana-3-0-0-and-master-of-today-dont-show-records/16700/3 "2014-03-30T16:40:56Z")
The problems was this line...
_"index.query.default\_field" : "@message"_
Why?
Thanks.
On Sunday, March 30, 2014 6:20:34 PM UTC+2, Israel Calvete wrote:
> Ok
>
> I have a template...
>
> _{_
>
> -
>
> ```
> "template" : "logstash*",*
>
> ```
>
> -
>
> ```
> "settings" : {*
>
> ```
>
> -
>
> ```
> "index.store.compress.stored" : "true",*
>
> ```
>
> -
>
> ```
> "index.cache.field.type" : "soft",*
>
> ```
>
> -
>
> ```
> "index.query.default_field" : "@message",*
>
> ```
>
> -
>
> ```
> },*
>
> ```
>
> -
>
> ```
> "mappings" : {*
>
> ```
>
> -
>
> ```
> "_default_" : {*
>
> ```
>
> -
>
> ```
> "_all" : {"enabled" : false},*
>
> ```
>
> -
>
> ```
> "_source": { "compress": true },*
>
> ```
>
> -
>
> ```
> "properties" : {*
>
> ```
>
> -
>
> ```
> "@fields" : {*
>
> ```
>
> -
>
> ```
> "type" : "object",*
>
> ```
>
> -
>
> ```
> "dynamic": true,*
>
> ```
>
> -
>
> ```
> "path": "full",*
>
> ```
>
> -
>
> ```
> "properties" : {*
>
> ```
>
> -
>
> ```
> "errnum" : { "type":
>
> ```
>
> "integer"}\*
>
> -
>
> ```
> }*
>
> ```
>
> -
>
> ```
> },*
>
> ```
>
> -
>
> ```
> "@message": { "type": "string", "index":
>
> ```
>
> "analyzed" },\*
>
> -
>
> ```
> "@source": { "type": "string", "index":
>
> ```
>
> "not\_analyzed" },\*
>
> -
>
> ```
> "@source_host": { "type": "string",
>
> ```
>
> "index": "not\_analyzed" },\*
>
> -
>
> ```
> "@source_path": { "type": "string",
>
> ```
>
> "index": "not\_analyzed" },\*
>
> -
>
> ```
> "@tags": { "type": "string", "index":
>
> ```
>
> "not\_analyzed" },\*
>
> -
>
> ```
> "@timestamp": { "type": "date", "index":
>
> ```
>
> "not\_analyzed" },\*
>
> -
>
> ```
> "@type": { "type": "string", "index":
>
> ```
>
> "not\_analyzed" }\*
>
> -
>
> ```
> }*
>
> ```
>
> -
>
> ```
> }*
>
> ```
>
> -
>
> ```
> }*
>
> ```
>
> _}_
>
> Without template works, but I don't know why.
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/111a08d7-c588-48c4-bccc-4b29263a0e1c%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/111a08d7-c588-48c4-bccc-4b29263a0e1c%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@Binh\_Ly\_2](https://discuss.elastic.co/u/Binh_Ly_2)
#### Post date: [March 31, 2014, 8:25pm UTC](https://discuss.elastic.co/t/kibana-kibana-3-0-0-and-master-of-today-dont-show-records/16700/4 "2014-03-31T20:25:56Z")
If the @message field is not in your event document, that could explain why
you're not getting any hits back.
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/74750ca7-5ee9-467b-ad3f-94a972c67b00%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/74750ca7-5ee9-467b-ad3f-94a972c67b00%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:39am UTC](https://discuss.elastic.co/t/kibana-kibana-3-0-0-and-master-of-today-dont-show-records/16700/5 "2017-07-06T01:39:14Z")