Kibana Web Console shows zero records when some docs don't have timestamp


ES and Kibana versions 7.7.0

In this example I have three docs that are loaded into ElasticSearch.
The mapping has a timestamp

However one doc does not have a timestamp field
"browser_type": "Firefox",
"ts": "1592330708",
"userid": "489531"
"browser_type": "Chrome",
"ts": "1592340708",
"userid": "489531"

"browser_type": "Mozilla",
"userid": "489532"

CASE 1 : Index Pattern with TimeFilter field name
In this case Kibana Web Console (Discover) shows zero records

"No results match your search criteria
Expand your time range
One or more of the indices you’re looking at contains a date field. Your query may not match anything in the current time range, or there may not be any data at all in the currently selected time range. You can try changing the time range to one which contains data."

**CASE 2 : Index Pattern with NO TimeFilter field **
Kibana displays all records. The GOTCHA is now we cannot select a time-range

My Question
If you define a TimeFilter field in an Index-Pattern , does every record necessarily need to have ts field in the doc in order to display all the docs on the Discover Web Console?

Thanks for your help




However, you Case 1 example should return documents if the timestamps are within the time filter ranges.

Thank you @mattkime Matt
I just observed that in my dataset the timestamp is defined in SECONDS

Is this the problem perhaps ?

I can convert the time to MILLISECONDS and test again



Yes, thats possible, as such an error could cause the documents to be outside the selected time range.

Thanks @mattkime Matt
I am running a side-by-side comparison of loading two indices (one with SEC and second with MILLISEC) to see if this is indeed the issue
Will report back for a closure :slight_smile:
Thanks Matt

1 Like

All right , I confirmed it. When I converted all SECONDS to MILLISECONDS in my dataset then KIBANA is perfectly displaying the records. Thanks again Matt @mattkime



This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.