Purpose of Time filter in Kibana

[zaeemmasood]

Hi All,

What is the significance of "Time filter" when setting up an index pattern or Data view?

When setting it up it says Select a primary time field for use with the global time filter

Thanks

[Tortoise]

Hello,

As per my understanding this timestamp/timefilter will help you in reviewing the data which is indexed over time duration. As well as when you create a dashboard it will help, so if you do not select this field you will see all your data at once which might not be the ideal scenario.

[stephenb (Stephen Brown)]

@zaeemmasood

When setting it up it says Select a primary time field for use with the global time filter

It is the time field that will be used by the time picker to filter results in Discover, Dashboard and Curated UIs etc

[zaeemmasood]

Thanks. Can you please elaborate this? Discover still shows @timstamp field.

So in Discover would the messages appear sorted based on “recvdTime” in my case?

Thanks

[stephenb (Stephen Brown)]

@zaeemmasood

So in Discover would the messages appear sorted based on “recvdTime” in my case?

To be precise the discover results will be filtered by recvdTime and in general the default sorting is by the data view time field, but you can sort by other fields once the data is brought back.

Create a data view | Kibana Guide [8.16] | Elastic

Discover | Kibana Guide [8.16] | Elastic

I suggest rolling up your sleeves and getting in there and try it.

You can create 2 dataviews... one on with @timestamp and one with recvdTime and compare and look at the differences...

@zaeemmasood

Discover still shows @timestamp field.

if it still in the first column then you probably did not set up the Data View Correctly

Also Setting the time field in the data view DOES not remove any fields so @timestamp will still be available.

See example below I created a data view with the time field set to event.ingested

And then Discover filters and displays event.ingested

[zaeemmasood]

Thanks!