# Unable to search documents in Kibana that is indexed using attachment plugin

**URL:** <https://discuss.elastic.co/t/unable-to-search-documents-in-kibana-that-is-indexed-using-attachment-plugin/66362>\
**Category:** Kibana\
**Created:** [November 17, 2016, 10:12am UTC](https://discuss.elastic.co/t/unable-to-search-documents-in-kibana-that-is-indexed-using-attachment-plugin/66362 "2016-11-17T10:12:48Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![YuWatanabe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuwatanabe/32/13259_2.png) [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\
**Post date:** [November 17, 2016, 10:12am UTC](https://discuss.elastic.co/t/unable-to-search-documents-in-kibana-that-is-indexed-using-attachment-plugin/66362/1 "2016-11-17T10:12:48Z")

</div>

I have indexed a base64 encoded attachment using latest **ingest-attachment** plugin.

My elsaticsearch and kibana environment is below.

```
[root@filebeat elasticsearch]# rpm -qa | grep kibana
kibana-5.0.1-1.x86_64
[root@filebeat elasticsearch]# rpm -qa | grep elasticsearch
elasticsearch-5.0.1-1.noarch

```

However, indexed document is not searchable from Kibana Discovery.

![](https://us1.discourse-cdn.com/elastic/original/2X/b/bb44e9e96fed1fdfaecd443f95edef200cf484d7.png)

Doument definitely exists when I search from the query.

```
{
  "took": 6,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 2,
    "max_score": 1,
    "hits": [
      {
        "_index": "test",
        "_type": "test",
        "_id": "1",
        "_score": 1,
        "_source": {
          "date": "2016-11-17T18:50:00",
          "data": "H4sICFVwLVgAA2RhdGUudHh0AAvJKFXwyy9TMDRXMLCwMjWxMjFVCA1xVjAyMDTjAgBpNz/EHQAAAA==",
          "attachment": {
            "content_type": "application/gzip",
            "content_length": 0
          }
        }
      },
      {
        "_index": "test",
        "_type": "test",
        "_id": "3",
        "_score": 1,
        "_source": {
          "date": "2016-11-17T18:55:00",
          "data": "H4sICFVwLVgAA2RhdGUudHh0AAvJKFXwyy9TMDRXMLCwMjWxMjFVCA1xVjAyMDTjAgBpNz/EHQAAAA==",
          "attachment": {
            "content_type": "application/gzip",
            "content_length": 0
          },
          "subject": "My First attachment",
          "from": "creationline@localhost.localdomain",
          "to": "root@localhost.localdomain"
        }
      }
    ]
  }
}

```

Below is the query.

```
GET test/test/_search
{
  "query" : {
    "range" : {
      "date" : {
        "gte" : "now-1y"
      }
    }
  }
}

```

May I ask how can I debug the kibana query?

---

<div class="post-metadata">

**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\
**Post date:** [November 17, 2016, 6:16pm UTC](https://discuss.elastic.co/t/unable-to-search-documents-in-kibana-that-is-indexed-using-attachment-plugin/66362/2 "2016-11-17T18:16:22Z")

</div>

I was able to reproduce after indexing documents based on your post, and I found that I had to use an absolute time range in the date picker, because the dates are in the future in my timezone. It looks like if you use a relative date from some time in the past up until "now", then it doesn't show documents for the future.

Can you try using an absolute time range in the Kibana date picker? It looks like the dates in your documents might be in the future, and that could be throwing off Discover. You can also try **Quick / Today**

 ![](https://us1.discourse-cdn.com/elastic/original/2X/d/d6b4f299df308a471938346676c0015297b02084.png)

---

<div class="post-metadata">

**Author:** ![YuWatanabe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuwatanabe/32/13259_2.png) [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\
**Post date:** [November 18, 2016, 2:18am UTC](https://discuss.elastic.co/t/unable-to-search-documents-in-kibana-that-is-indexed-using-attachment-plugin/66362/3 "2016-11-18T02:18:49Z")

</div>

@tsullivan

Thanks for the support.

You are right. This was a timezone issue. I was able to work it out.

What was behind the scene was kibana automatically recognizes the client side timezone and adjust it when searches documents in discovery . So I use kibana in **JST** region and kibana adds **+0900** to the timestamp field.

I just indexed a document this morning as below. Time is **2016-11-18 11:03:00**

![](https://us1.discourse-cdn.com/elastic/original/2X/0/03e58931707bc9f346280ce442f32f2dd596d192.PNG)

Discover shows timestamp in **+0900** manner.

 ![](https://us1.discourse-cdn.com/elastic/original/2X/9/956648a816531f8a211cdf08bfc06187c0f904c0.PNG)

I didn't realize this issue till now because I usually use filebeat + logstash which automatically converts the time into UTC and then index the document.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 16, 2016, 2:18am UTC](https://discuss.elastic.co/t/unable-to-search-documents-in-kibana-that-is-indexed-using-attachment-plugin/66362/4 "2016-12-16T02:18:49Z")

</div>

Closed on December 16, 2016, 2:18am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.