Unable to sort kibana based on timestamp in UI but API call works

Elastic Stack Kibana
1

I am having an issue where am unable to sort logs in kibana based on kibana in our production environment but works fine in pre-production. Our index pattern is logstash-cos-* and time field is set to @timestamp. In one of previous cases we just re-indexed a single day ES index(for e.g. logstash-cos-2017.09.01) and created a single day index pattern on kibana UI and was able to sort based on timestamp. Then we deleted and re-created the overall logstash-cos-* index pattern on UI and was able to sort that index pattern logs too, but this time the same process didn't work.

By comparing our pre-prod(where sorting based on time works on UI) vs our production. we excluded some of additional raw message fields(using scripted fields on UI) that we are indexing and it seemed to have fixed in one of the environment but it didn't fix other production environments. We are wondering if it's more of kibana thing than ES indexing thing. Any advise would be greatly appreciated. Please post if you want to look at some of our logs and mapping if that would help diagnose issue. Screenshots attached below
Prod environments

image
image.png1010×687 25.2 KB

image
image.png714×589 19.6 KB

Pre-prod environment
Please notice the small arrow mark next to Time column which we are missing in production environment

image

Also our discover panel url in one of production environment routes to
:5601/app/kibana#/discover?_g=h@44136fa&_a=h@9435744

whereas in other prod and pre-prod environments it displays the filter columns in
app/kibana#/discover?_g=()&_a=(columns:!(beat.version),index:'logstash-cos-*',interval:auto,query:'',sort:!(_score,desc)) --> sorting by score not timestamp in another prod

in pre-prod the URL is
_g=()&_a=(columns:!(beat.version),index:'logstash-cos-',interval:auto,query:(query_string:(analyze_wildcard:!t,query:'')),sort:!('@timestamp',desc))

Not sure why one the difference is in 1st URL which routes to _g=h@44136fa&_a=h@9435744

Thanks in advance?

2

Can you provide the mappings for the @timestamp field from both of the clusters? I'm guessing that the field in production doesn't support sorting for some reason.

3

We have multiple logstash runners processing different kafka topics. This is @timestamp mapping from one such topic across environments

Production environment
{"string_fields":{"match":"*","match_mapping_type":"string","mapping":{"fields":{"keyword":{"type":"keyword"}},"norms":false,"type":"text"}}}],"properties":{"@timestamp":{"type":"date","include_in_all":false},"

Pre-prod Staging environment
{"string_fields":{"match":"*","match_mapping_type":"string","mapping":{"fields":{"keyword":{"type":"keyword"}},"norms":false,"type":"text"}}}],"properties":{"@timestamp":{"type":"date","include_in_all":false}

Pre-prod UAT environment
{"string_fields":{"match":"*","match_mapping_type":"string","mapping":{"fields":{"keyword":{"type":"keyword"}},"norms":false,"type":"text"}}}],"properties":{"@timestamp"{"type":"date","include_in_all":false},

Please let me know if you need further information. Note, we are able to sort based on @timestamp using API

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.