I have some basic visualizations set up to calculate some basic things from the documents in elastic search. The data is basic product analytics information for some alpha software. I only have ~4 days of documents in elastic search, and not much at that (~600 documents in this index logstash-clients-) We do have ~2 million documents in a different index (logstash-) if it matters.
When I look in the Discover tab, I see 21 unique user ids (event.local_user_id) within the first 500 records (I pasted the first 500 records into excel and de-duped on that column)
Note datetime and user ids, 3 unique seen in the frame of this screenshot.
Then in these two visualizations, these documents don't appear to be part of the visualizations and I don't see anything that is keeping them filtered out.
In the above visualization, note how Feb 1st doesn't have any user ids present, when they appear to be present on the first screenshot.
Second visualization, would expect this count to be at least 20, if not higher.
The only thing that I can think of is ts the field in visualizations are ".keyword" -- I've tried to google this and not sure what it means and why it is appended to the end of the field.
Thank you in advance,