Kibana's discover tab has a button in the upper right to get debug information somewhere in there you can get the query it issued. Sorry I can't be more precise. I dont remember it well.
Anyway, my guess is that the query you made by hand doesn't match the kibana one.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.