Why would Kibana not show all docs?

Elastic Stack Kibana
1

I just created an index with 235 docs all created within the same second. In devtools a search returns all 235 docs, however Kibana, on the first screen before any filtering only returns 177.

I don't know where to look for the problem, any ideas?

Stack version is 8.1.3. Docs were created with Python API bulk with the current time for @timestamp and _id was generated.

2

however Kibana, on the first screen before any filtering only returns 177.

What version of kibana are you running? What is the "first screen"? Kibana has lots of applications. If you are using Discover, have you tried opening "inspector"? That will show you the request/response for the data you are viewing

3

Yes, discover version 8.1.3.

Request:

{
  "track_total_hits": false,
  "sort": [
    {
      "@timestamp": {
        "order": "desc",
        "unmapped_type": "boolean"
      }
    }
  ],
  "fields": [
    {
      "field": "*",
      "include_unmapped": "true"
    },
    {
      "field": "@timestamp",
      "format": "strict_date_optional_time"
    }
  ],
  "size": 500,
  "version": true,
  "script_fields": {},
  "stored_fields": [
    "*"
  ],
  "runtime_mappings": {},
  "_source": false,
  "query": {
    "bool": {
      "must": [],
      "filter": [
        {
          "range": {
            "@timestamp": {
              "format": "strict_date_optional_time",
              "gte": "2022-05-18T13:00:00.000Z",
              "lte": "2022-05-19T13:51:12.092Z"
            }
          }
        }
      ],
      "should": [],
      "must_not": []
    }
  },
  "highlight": {
    "pre_tags": [
      "@kibana-highlighted-field@"
    ],
    "post_tags": [
      "@/kibana-highlighted-field@"
    ],
    "fields": {
      "*": {}
    },
    "fragment_size": 2147483647
  }
}

Response trimmed of our data:
image
...
image

Stats show 177 hits.

4

What is the result if you run the same Kibana query in dev tools?

GET your-index/_search
{
"query": {
    "bool": {
      "must": [],
      "filter": [
        {
          "range": {
            "@timestamp": {
              "format": "strict_date_optional_time",
              "gte": "2022-05-18T13:00:00.000Z",
              "lte": "2022-05-19T13:51:12.092Z"
            }
          }
        }
      ],
      "should": [],
      "must_not": []
    }
  }
}

Can you track a document that is appearing in dev tools but not in Kibana and share it?

5

Ok, some have 1970 dates..... I'll have to see if it's an input or indexing error.

Thanks

1 Like
6

It looks like when the timestamp is "short", it's not indexing correctly.

image

@timestamp has mapping type of epoch_millis and epoch_second. I'm not sure which handles these with decimals.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.