Kibana Web Console shows zero records when some docs don't have timestamp

Elastic Stack Kibana
1

Hi

ES and Kibana versions 7.7.0

In this example I have three docs that are loaded into ElasticSearch.
The mapping has a timestamp

However one doc does not have a timestamp field
{
"browser_type": "Firefox",
"ts": "1592330708",
"userid": "489531"
}
{
"browser_type": "Chrome",
"ts": "1592340708",
"userid": "489531"
}

{
"browser_type": "Mozilla",
"userid": "489532"
}

CASE 1 : Index Pattern with TimeFilter field name
In this case Kibana Web Console (Discover) shows zero records

"No results match your search criteria
Expand your time range
One or more of the indices you’re looking at contains a date field. Your query may not match anything in the current time range, or there may not be any data at all in the currently selected time range. You can try changing the time range to one which contains data."

**CASE 2 : Index Pattern with NO TimeFilter field **
Kibana displays all records. The GOTCHA is now we cannot select a time-range

My Question
If you define a TimeFilter field in an Index-Pattern , does every record necessarily need to have ts field in the doc in order to display all the docs on the Discover Web Console?

Thanks for your help

warmly

sanjay

2

Yes.

However, you Case 1 example should return documents if the timestamps are within the time filter ranges.

3

Thank you @mattkime Matt
I just observed that in my dataset the timestamp is defined in SECONDS

Is this the problem perhaps ?

I can convert the time to MILLISECONDS and test again

Thanks

sanjay

4

Yes, thats possible, as such an error could cause the documents to be outside the selected time range.

5

Thanks @mattkime Matt
I am running a side-by-side comparison of loading two indices (one with SEC and second with MILLISEC) to see if this is indeed the issue
Will report back for a closure :slight_smile:
Thanks Matt
sanjay

1 Like
6

All right , I confirmed it. When I converted all SECONDS to MILLISECONDS in my dataset then KIBANA is perfectly displaying the records. Thanks again Matt @mattkime

warmly

sanjay

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.