Kibana visualizations not showing some documents?

Elastic Stack Kibana
1

Hi everyone,
I have some basic visualizations set up to calculate some basic things from the documents in elastic search. The data is basic product analytics information for some alpha software. I only have ~4 days of documents in elastic search, and not much at that (~600 documents in this index logstash-clients-) We do have ~2 million documents in a different index (logstash-) if it matters.

When I look in the Discover tab, I see 21 unique user ids (event.local_user_id) within the first 500 records (I pasted the first 500 records into excel and de-duped on that column)

kibana3
kibana3.png1251×1297 74.1 KB

Note datetime and user ids, 3 unique seen in the frame of this screenshot.

Then in these two visualizations, these documents don't appear to be part of the visualizations and I don't see anything that is keeping them filtered out.

kibana2
kibana2.png1279×1105 76.4 KB

In the above visualization, note how Feb 1st doesn't have any user ids present, when they appear to be present on the first screenshot.

Second visualization, would expect this count to be at least 20, if not higher.

image
image.png1238×713 34.8 KB

The only thing that I can think of is ts the field in visualizations are ".keyword" -- I've tried to google this and not sure what it means and why it is appended to the end of the field.

Thank you in advance,
Kyle

2

It looks like you are running 5.X, you should definitely upgrade to get access to the awesomeness in 6.1 :smiley:

In the first screenshot, the time displayed is not event.t. You may want to add that to the Selected Fields and remove that Time one to properly sort the events.

3

I'll check out the change log for 6.1 and see if there is enough to tempt me... :smiley: This is indeed 5.5.2

Good eyes on catchingTime vs event.t @warkolm ... They are identical however so I don't think that has solved my issue. (I thought maybe we had screwed it up though so you got me excited)

image
image.png2840×1525 308 KB

4

I wanted to confirm changing the date in the visualizations has not solved the problem...

As you can see from the other reply, the times are the same in both fields.

Any other suggestions?

5

Issue is still persisting. I can post more screenshots if it would help. Please let me know what else I should check / post.

Thank you!

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.