Removing the range from the query gives results. However its the same amount of results as when I simply pick a long date (last 2 years) in the timepicker in the UI. That just tells me that its using the old data but still not matching on the newer data.
Here is when I removed the range
{ "took": 29107, "timed_out": false, "num_reduce_phases": 8, "_shards": { "total": 3856, "successful": 3856, "skipped": 0, "failed": 0 }, "hits": { "total": 26846, "max_score": 0, "hits": [] }, "aggregations": { "2": { "doc_count_error_upper_bound": 0, "sum_other_doc_count": 36, "buckets": [ { "key": "PRDEXCH001", "doc_count": 11606 }, { "key": "PRDEXCH002", "doc_count": 7099 }, { "key": "PRDEXCH003", "doc_count": 5548 }, { "key": "PRDDC100", "doc_count": 325 }, { "key": "PRDDC200", "doc_count": 86 } ] } } }
Here is when I just picked last 2 years in the timepicker
{ "size": 0, "aggs": { "2": { "terms": { "field": "event.host.keyword", "size": 5, "order": { "_count": "desc" } } } }, "version": true, "_source": { "excludes": [] }, "stored_fields": [ "*" ], "script_fields": {}, "docvalue_fields": [ "@timestamp", "event_data.DeviceTime", "event_data.NewTime", "event_data.OldTime", "event_data.StartTime", "event_data.StopTime", "user_data.UTCStartTime" ], "query": { "bool": { "must": [ { "match_all": {} }, { "match_all": {} }, { "bool": { "should": [ { "match_phrase": { "level": "Error" } }, { "match_phrase": { "level": "error" } } ], "minimum_should_match": 1 } }, { "bool": { "should": [ { "match_phrase": { "log_name": "Application" } }, { "match_phrase": { "log_name": "application" } } ], "minimum_should_match": 1 } }, { "range": { "@timestamp": { "gte": 1458139115131, "lte": 1521211115131, "format": "epoch_millis" } } } ], "filter": [], "should": [], "must_not": [] } }, "highlight": { "pre_tags": [ "@kibana-highlighted-field@" ], "post_tags": [ "@/kibana-highlighted-field@" ], "fields": { "*": {} }, "fragment_size": 2147483647 } }
RESPONSE
{ "took": 1218, "timed_out": false, "num_reduce_phases": 7, "_shards": { "total": 3695, "successful": 3695, "skipped": 121, "failed": 0 }, "hits": { "total": 26840, "max_score": 0, "hits": [] }, "aggregations": { "2": { "doc_count_error_upper_bound": 0, "sum_other_doc_count": 36, "buckets": [ { "key": "PRDEXCH001", "doc_count": 11606 }, { "key": "PRDEXCH002", "doc_count": 7099 }, { "key": "PRDEXCH003", "doc_count": 5548 }, { "key": "PRDDC100", "doc_count": 318 }, { "key": "PRDDC200", "doc_count": 86 } ] } }, "status": 200 }