Hi, i used logstash to load data from MSSQL database to Elasticsearch. Since I lost 8 hours each time I imported the time field, I manually added 8 hours, for example: I have a sql in conf file of logstash : dateadd(hh,8,starttime) as starttime .However when I use now-1d/d to search the data yesterday , I found it didnot work correctly . The data showed incomplete.How can I solve this problem ? Looking forward to your reply .Thanks!
Hey @Echo_yu
Sounds like a timezone issue to me.
Which app is this happening in?
Can you share some screenshots of the incompletness?
Hi，I wrote query in vega of kibana to get my data from elasticsearch, and i have to set the date range like this to get all of yesterday's data . And I did some search in Discover of kibana when i apply one of my date field time into filtter, i found it missing 8 hours!
image|690x295 Could you give me some suggestions on this issues?Thanks!
Just to make sure I understand:
- In your MYSQL you have a record with a date like this:
2020-04-05 19:00:00 - And when ingesting it you added 8 hours, so now in ES you have
2020-04-06 03:00:00 - Now you're running a query for the 5th (assuming today is the 6th) and you're using
now-1d. The query gets all data for2020-04-05 00:00:00-2020-04-05 23:59:59and this record is not returned.
Correct?
Hi，in my db i have a record with a date like this: 2020-04-05 19:00:00 and i found it showed like this in the kibana: 2020-04-05 11:00:00, so i manually added 8 hours to make it look the same as the time in my db with a sql: dateadd(hh,8,startdatetime) as startdatetime .Now i am running a query for the 5th(assuming today is the 6th) and i am using gte:now-1d/d,lt:now+0d/d but i cannot get all the data for 2020-04-05 00:00:00 - 2020-04-05 23:59:59 and when i add one of the value of startdatetime I found the filter time also change like this:
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.