Unable to search with timestamp

[Vijay_Chander]

I've created an index with two doc types(sas_logs & pid_logs) of different formats.

The logstash config file is

input {
file {
path => "E:/ElasticSearchWork/pid_logs/.log"
type => "pid_logs"
start_position => "beginning"
sincedb_path => "/dev/null"
}
file {
path => "E:/ElasticSearchWork/sas_logs/.log"
type => "sas_logs"
start_position => "beginning"
sincedb_path => "/dev/null"
}
}

filter {

if [type] == "pid_logs" {
grok {
match => { "message" => "pid: (?\d+) mem: (?\d+) cpu: (?\d+)" }
}
}

if [type] == "sas_logs" {
grok {
match => { "message" => "%{LOGLEVEL:loglevel}\s+[%{NUMBER:num}]\s+:%{USERNAME:user}\s+-\s+%{GREEDYDATA:msg}" }
}
}
}

output {
elasticsearch {
hosts => "http://localhost:9200"
index => "com_index"
}
stdout {
codec => rubydebug
}
}

The log formats are

sas_logs: INFO [00000006] :sasdemo - NOTE: Copyright (c) 2016 by SAS Institute Inc., Cary, NC, USA.

pid_logs: pid: 2178 cpu: 0.2 mem: 0.3

I'm trying to search in the kibana with the timestamp as I need to map/get the data from both the logs at particular timestamp.

In Kibana

Can anyone please help me in this.

[magnusbaeck (Magnus Bäck)]

Have you tried removing the space after @timestamp:?

[Vijay_Chander]

Yes, Even I've tried to search one exact timestamp value, still its returns empty.

I'm working on this from last two days but no luck.

[magnusbaeck (Magnus Bäck)]

Maybe it's the colons that's throwing the query parser off. Trying double-quoting the value, i.e. @timestamp:"2018-08-03T....".

(I've never had the need to search for documents matching an exact timestamp.)

[Vijay_Chander]

Magnus you're an angel It worked. I've tried the same before but forgot the '@' before timestamp variable as the logs also have a timestamp(custom) variable.