Not able to search on indexed fields in Kibana

Elastic Stack Kibana
1

Hi

I am using elasticsearch 2.1.2 version and Kibana 4.2.2 version.
I had a index in ES using below:
curl -XPUT http://localhost:9200/abc/tbl/_mapping -d'{
"tbl": {
"_timestamp": {
"enabled": true
},
"_all": {
"store": true
},
"properties": {
"name": {
"type": "string",
"index": "not_analyzed"
},
"num": {
"type": "long"
},
"date": {
"type": "date",
"format": "yyyy-MM-dd"
}
}
}
}'

and it is having indexed data and also data is mapped to Kibana. Please see snapshot:

kibana.png1366×768 42.4 KB

and when I scroll to Discover page it shows no indexed field to search..
noindex.png1366×768 83.2 KB

Why? Am I doing something wrong? Help me.

2

What do you get when you run the following query ?

POST http://localhost:9200/abc*/_search 
{
  "query": {
    "range": {
      "@timestamp": {
        "gte": "now-1w/d",
        "lt": "now/d"
      }
    }
  }
}
3

{
"took" : 2,
"timed_out" : false,
"_shards" : {
"total" : 5,
"successful" : 5,
"failed" : 0
},
"hits" : {
"total" : 7,
"max_score" : 1.0,
"hits" : [ {
"_index" : "abc",
"_type" : "tbl",
"_id" : "573da47b9616b62160765597",
"_score" : 1.0,
"_timestamp" : 1463657777257,
"_source":{"num": 20.0, "name": "ankit"}
},
..........[other indexed data]
, {
"_index" : "abc",
"_type" : "tbl",
"_id" : "573da4b59616b6216076559a",
"_score" : 1.0,
"_timestamp" : 1463657777257,
"_source":{"num": 20.0, "name": "praveen"}
} ]
}
}
curl: (3) [globbing] nested brace in column 15

4

Sorry for typo, the query was (date instead of @timestamp) :

POST http://localhost:9200/abc*/_search 
{
  "query": {
    "range": {
      "date": {
        "gte": "now-1w/d",
        "lt": "now/d"
      }
    }
  }
}

Anyway, according to your answer, it seems that :

  • you are using _timestamp field which is deprecated
  • your data does not contain any date field

When you added your index in kibana, what were the date fields that were proposed to you?

5

I had a date field (as name and num) but there is no data in it. Now I added some data and following your query output is:
{
"took" : 3,
"timed_out" : false,
"_shards" : {
"total" : 5,
"successful" : 5,
"failed" : 0
},
"hits" : {
"total" : 5,
"max_score" : 1.0,
"hits" : [ {
"_index" : "abc",
"_type" : "tbl",
"_id" : "5743dd5087675117e31d9529",
"_score" : 1.0,
"_timestamp" : 1464065500396,
"_source":{"date": "2016-01-17", "num": 25.0, "name": "xyz"}
}, {
"_index" : "abc",
"_type" : "tbl",
"_id" : "5743dd8887675117e31d952c",
"_score" : 1.0,
"_timestamp" : 1464065500396,
"_source":{"date": "2016-03-04", "num": 23.0, "name": "abc"}
} ]
}
}

  • In kibana I used date as date field and it is shown in screenshot shared previously.
  • Also I know _timestamp field is depricated but using ES mapping I forced it to have a value which is shown in ouput.
6

Waiting for response..

7

Are you sure that you have executed the exact query below?

POST http://localhost:9200/abc*/_search 
{
  "query": {
    "range": {
      "date": {
        "gte": "now-1w/d",
        "lt": "now/d"
      }
    }
  }
}

It is quite surprising to get result with date value 2016-01-17 with this query...