I am able to upload the following data into my ES Cluster, and have an index template apply to it. However the default search of kibana (using an index pattern) doesn't query the data.
Index Template that gets applied to the indices:
{
"properties": {
"@timestamp": {
"format": "epoch_millis||strict_date_optional_time",
"index": true,
"ignore_malformed": false,
"store": false,
"type": "date",
"doc_values": true
}
}
}
I see the data in ES:
curl --location --request POST 'http://es-node-2:9200/*grpc*/_search' \
--header 'Content-Type: application/json' \
--data-raw '{
"size": 500,
"sort": [
{
"@timestamp": {
"order": "desc",
"unmapped_type": "boolean"
}
}
],
"version": true,
"fields": [
{
"field": "*",
"include_unmapped": "true"
},
{
"field": "@timestamp",
"format": "strict_date_optional_time"
}
],
"aggs": {
"2": {
"date_histogram": {
"field": "@timestamp",
"fixed_interval": "10m",
"time_zone": "America/New_York",
"min_doc_count": 1
}
}
},
"script_fields": {},
"stored_fields": [
"*"
],
"runtime_mappings": {},
"_source": false
}'
"hits": {
"total": {
"value": 3,
"relation": "eq"
},
"max_score": null,
"hits": [
{
"_index": "cisco-ios-xr-ip-rib-ipv4-oper-rib-vrfs-vrf-afs-af-safs-saf-ip-rib-route-table-names-ip-rib-grpc-2021.04.14",
"_type": "_doc",
"_id": "wNxF0XgBgKJ8dEf0YYZq",
"_version": 1,
"_score": null,
"fields": {
"keys.vrf-name.keyword": [
"default"
],
"keys.vrf-name": [
"default"
],
"keys.saf-name": [
"Unicast"
],
"content.entry.keyword": [
"0.0.0.0"
],
"keys.af-name": [
"IPv4"
],
"keys.route-table-name": [
"default"
],
But when Kibana tries to query it, I don't see any results:
{
"size": 500,
"sort": [
{
"@timestamp": {
"order": "desc",
"unmapped_type": "boolean"
}
}
],
"version": true,
"fields": [
{
"field": "*",
"include_unmapped": "true"
},
{
"field": "@timestamp",
"format": "strict_date_optional_time"
}
],
"aggs": {
"2": {
"date_histogram": {
"field": "@timestamp",
"fixed_interval": "10m",
"time_zone": "America/New_York",
"min_doc_count": 1
}
}
},
"script_fields": {},
"stored_fields": [
"*"
],
"runtime_mappings": {},
"_source": false,
"query": {
"bool": {
"must": [],
"filter": [
{
"match_all": {}
},
{
"range": {
"@timestamp": {
"gte": "2021-04-14T02:01:38.062Z",
"lte": "2021-04-14T17:01:38.062Z",
"format": "strict_date_optional_time"
}
}
}
],
"should": [],
"must_not": []
}
},
"highlight": {
"pre_tags": [
"@kibana-highlighted-field@"
],
"post_tags": [
"@/kibana-highlighted-field@"
],
"fields": {
"*": {}
},
"fragment_size": 2147483647
}
}
How can I make Kibana search similar to what I am searching for?
I use grpc index pattern and have @timestamp set.
Thanks,
Greg
