Time-Field Name Not Clearing After Delete and Recreate of Index

[joshheil]

I'm fairly new to ELK and I'm working with a custom index in ES. I set the index in Kibana and selected the time-based field for one of the properties on the document, which returns 0 results. I have two questions here.

The first question is if this custom datetime field is formatted as so, 2015-07-06T17:02:34.2664295-04:00 then do I need to change the formatting fields in the settings of Kibana? Right now I am getting 0 results back on a * query, when I know there's data in ES.

The second question I have is when I delete and recreate the index in Kibana attempting to create it without the time-based field, the same field is still set as the time based field. This seems like a bug but it could be my lack of knowledge with Kibana. If that's the case, then I can enter a bug, but I wanted to get some input from the community before creating either a known bug or something that is not a bug at all.

Any help is greatly appreciated.

[tbragin (Tanya Bragin)]

@joshheil

The first question is if this custom datetime field is formatted as so, 2015-07-06T17:02:34.2664295-04:00 then do I need to change the formatting fields in the settings of Kibana? Right now I am getting 0 results back on a * query, when I know there's data in ES.

If Kibana allows you to configure a field as a time-based field, then it recognizes it. Are you searching for * across a large enough time interval? The default is "Last 15 minutes".

@joshheil

The second question I have is when I delete and recreate the index in Kibana attempting to create it without the time-based field, the same field is still set as the time based field.

I'm experiencing the same problem. I was able to work around it by manually deleting the index in ES (it's stored in .kibana/index-pattern/your_index_name), but I'd file this as an issue in Issues · elastic/kibana · GitHub