# SQL query do not return whole data

**URL:** <https://discuss.elastic.co/t/sql-query-do-not-return-whole-data/269309>\
**Category:** Elasticsearch\
**Created:** [April 6, 2021, 9:26am UTC](https://discuss.elastic.co/t/sql-query-do-not-return-whole-data/269309 "2021-04-06T09:26:22Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![czmoku](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/czmoku/32/86604_2.png) [@czmoku](https://discuss.elastic.co/u/czmoku)\
**Post date:** [April 6, 2021, 9:26am UTC](https://discuss.elastic.co/t/sql-query-do-not-return-whole-data/269309/1 "2021-04-06T09:26:22Z")

</div>

Hello

We facing with issue with Apache Superset + elasticsearch. Apache Superset use the SQL (this one [Elasticsearch SQL: Query Elasticsearch Indices with SQL | Elastic](https://www.elastic.co/what-is/elasticsearch-sql)) and we notice problems with fetching old data. Our data are indexed by logstash with daily index rolling. I tested this query:

```auto
POST _sql 
{
    "query": "SELECT COUNT(*) AS count FROM \"logstash-data-*\" WHERE \"@timestamp\" >= CAST('2021-03-18T00:00:00' AS DATETIME) AND \"@timestamp\" < CAST('2021-03-19T00:00:00' AS DATETIME)"
}

```

As you can see, it is standard query with date between. Similar query is executed by Apache Superset.

If we query for data later than 8 days (for example today is 04-06, and we set range between 03-27 and 03-28) then we do not have any results and count is always "0". Same is for select with single column.  
When i made this time range in kibana directly, by using the discovery tab, then we got documents correctly.

We using Elasticsearch 7.4.0 for Debian build connected with three node cluster.

---

<div class="post-metadata">

**Author:** ![bogdan.pintea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bogdan.pintea/32/45740_2.png) [@bogdan.pintea](https://discuss.elastic.co/u/bogdan.pintea)\
**Post date:** [April 6, 2021, 4:11pm UTC](https://discuss.elastic.co/t/sql-query-do-not-return-whole-data/269309/2 "2021-04-06T16:11:23Z")

</div>

Hi @czmoku ,

Not sure why you'd get different results, if your index pattern is the same and no [frozen indices](https://www.elastic.co/guide/en/elasticsearch/reference/current/frozen-indices.html) are involved, it should return the same data.

You could try to investigate it by [translating the query](https://www.elastic.co/guide/en/elasticsearch/reference/current/sql-translate.html) and executing the native Elasticsearch query directly and observing the results, so you could tweak your query if needed. The SQL engine does something similar.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 4, 2021, 4:11pm UTC](https://discuss.elastic.co/t/sql-query-do-not-return-whole-data/269309/3 "2021-05-04T16:11:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.