Apologies in advance as this is likely to be a stupid error on my part but it's got me stumped at the moment.
I'm running Elasticsearch and Kibana 7.12 and for some months have been using Logstash to input logging data. I use the Elapsed plugin in Logstash to populate a field on certain records with the latency of processing across a component - basically it calculates:
(end processing time - start processing time) = elapsedtime
This field (
elapsedtime) is defined to 3 decimal places in order to show milliseconds. The field definition is set as:
This has all been working fine, and then for some reason, from 00:00:00 on 7th June 2021 (01:00:00BST) my data in Kibana started displaying the
elapsedtime field rounded/shortened to just a single digit.
This is shown in the screenshot below. Notice the two records immediately prior to 01:00:00 display the value for
elapsedtime correctly (as I'd expect) whilst those after it do not.
What is confusing me is if I look at the underlying Elasticsearch documents for these IDs, they contain the full-precision values for
elapsedtime. For example, Kibana is displaying document ID 5HZkD3oBCcqIWceCDTch as having an
elapsedtime value of 3 (see screenshot above), whilst Elasticsearch shows that the underlying document contains the correct value of 3.039 as per the screenshot below:
Previously, Kibana would have been displaying the value 3.039, not 3.
Can anyone explain what might be happening here. I have not changed the index/field definitions recently, or changed the Elasticsearch, Kibana or Logstash processing from what I recall.
Thanks in advance,