I have an index with 3 documents in it. Each of the documents is very similar--they have the same fields and very close time stamps. When looking at the data in the Discover tab--with no filters and an empty search field--Kibana shows that there are 3 hits (correct), shows 3 buckets each with a count of 1 (correct), but only shows 2 of the documents. This happens regardless of the time range selected (last 5 years, last 24 hours, specific start/end time). This is Kibana 6.2.2 running on Ubuntu. What is happening?
Hmm, that's really strange. Could you click on the upwards arrow icon on the date histogram, then screenshot the data table and share here?
Sure. The data table looks exactly like I would expect. The times are correct, the counts are correct. The only thing that is off is the details of the documents. I've seen this same situation before, but this is the first time I could repeat it with simple data. If I copy the request and run it myself, I get the exact same response. There are three documents returned.
Actually, it is much worse than strange. With small indexes (< 20 documents), I have found multiple cases of the date histogram being wrong, multiple cases of missing documents in the browsing pane, and a single case where the Discover view simply shows "Searching" and never does anything else. In all cases, the cluster status is green, there is nothing in any log that I see that shows any sort of problem, and no reason to suspect malfunctioning hardware.
The date histogram frequently shows a count of 0.001 for some intervals, which is simply not correct. In a given 1 or 5 second interval, there is a minimum of 0 and a maximum of 1 for a count. I just don't see how the arithmetic can be this far off.
The missing documents make debugging data ingestion all but impossible. I find that between 5% and 30% of the documents I should see are not available for inspection. Has anyone verified this on large datasets? I can't imagine this being tolerable for anyone.
I even have one index pattern (which I've deleted and recreated multiple times), that simply shows nothing in the Discover tab. I understand that time and value filters can cause a "no documents" message, but all I get is "searching" and nothing ever happens. Given that the index has around 600 small documents, I don't see it as a timeout--and there is no timeout message--so what else can be broken? Also, the index is nearly identical to another one that works properly--similar time values, similar number of fields, and a name that is only different by a few characters.
Overall, these sorts of defects makes me stop trusting Kibana and by extension Elasticsearch as well.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.