# Unable to see documents in Discovery after applying an index template

**URL:** <https://discuss.elastic.co/t/unable-to-see-documents-in-discovery-after-applying-an-index-template/321553>\
**Category:** Kibana\
**Tags:** reindex\
**Created:** [December 19, 2022, 11:35am UTC](https://discuss.elastic.co/t/unable-to-see-documents-in-discovery-after-applying-an-index-template/321553 "2022-12-19T11:35:10Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![xzapata](https://avatars.discourse-cdn.com/v4/letter/x/a88e57/32.png) [@xzapata](https://discuss.elastic.co/u/xzapata)\
**Post date:** [December 19, 2022, 11:35am UTC](https://discuss.elastic.co/t/unable-to-see-documents-in-discovery-after-applying-an-index-template/321553/1 "2022-12-19T11:35:10Z")

</div>

Good morning,

I am unable to see my logs in Kibana (Discovery) after I apply an index template. At first, I mapped all fields (I deleted some) and after I saw it didn't work, I started out mapping only 2 fields of the many that there are. Can anyone help?

I'll explain exactly what I did  
1.- I simulated the entrance of logs using a pipeline with DevOps  
POST syslog-sophos.xg-2022.12.19/\_doc?pipeline=logs-sophos.xg-2.5.1  
{  
"@timestamp" : "2022-12-19T11:41:28.162308Z",  
"@version" : "1",  
"event" : {  
"original" : "\<182\>device="SFW" date=2022-12-19 time=11:41:35 timezone="CET" device\_name="XGS2300" device\_id=X2300000009743 log\_id=010101600001 log\_type="Firewall" log\_component="Firewall Rule" log\_subtype="Allowed" status="Allow" priority=...... ""  
},  
"host" : {  
"ip" : "192.168.10.220"  
},  
"message" : "\<182\>device="SFW" date=2022-12-19 time=11:41:35 timezone="CET" device\_name="XGS2300" device\_id=X2300000009743 log\_id=010101600001 log\_type="Firewall" log\_component="Firewall Rule" log\_subtype="Allowed" status="Allow" priority=...... "  
}

2.- The indexes were correctly created and I was able to query them from the console AND from Discovery.  
3.- I created the index using the UI of Kibana aiming at indexes "syslog-sophos.xg\*" with just fields  
source (object) \> ip (type: IP)  
destination (object) \> ip (type: IP)  
4.- I deleted the index b/c I know it won't work if field data types don't match between the index and the template.  
5.- Genereted more logs (step 1)  
6.- When I go to Discovery I can only see my old logs (older days). The data view is the same "syslog-\*"

---

<div class="post-metadata">

**Author:** ![xzapata](https://avatars.discourse-cdn.com/v4/letter/x/a88e57/32.png) [@xzapata](https://discuss.elastic.co/u/xzapata)\
**Post date:** [December 20, 2022, 9:30am UTC](https://discuss.elastic.co/t/unable-to-see-documents-in-discovery-after-applying-an-index-template/321553/2 "2022-12-20T09:30:04Z")

</div>

I couldn't see the events because field @timestamp is sent in GMT+0. Hence, if right now it's 10:27 (gmt+1), I should have sent this field set to 09:27 (gmt+0), for example:

POST syslog-sophos.xg-2022.12.19/\_doc?pipeline=logs-sophos.xg-2.5.1  
{  
"@timestamp" : "2022-12-19T **09:27** :28.162308Z",  
"@version" : "1",  
"event" : {  
"original" : "\<182\>device="SFW" date=2022-12-19 time= **10:27** :35 timezone="CET" device\_name="XGS2300" device\_id=X2300000009743 log\_id=010101600001 log\_type="Firewall" log\_component="Firewall Rule" log\_subtype="Allowed" status="Allow" priority=...... ""  
}, (... rest of the log ...)

I wasn't able to see the event obviously because the event was in the future...; I was able to see the event accidentally with the time filter "today"

You can close the ticket.

---

<div class="post-metadata">

**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\
**Post date:** [December 22, 2022, 2:07pm UTC](https://discuss.elastic.co/t/unable-to-see-documents-in-discovery-after-applying-an-index-template/321553/3 "2022-12-22T14:07:58Z")

</div>