Hi community,
Elasticsearch version: 6.7.0.
Grafana version: Grafana v6.2.2 (commit: 07540df)
I have a very strange issue. I use an Elasticsearch index to track some jobs.
When I select a large range time, Grafana shows me all data, but if I restrict the time range to one day, Grafana doesn’t show me data.
I tested with and without filter in query:
system: $system AND status: $deploy_status AND project: $project AND env: $env
With filter I have more data. If I select today doesn’t show anything.
In the second screenshot there is data point for today.
Sometimes when select a week Grafana shows me this error.
This is the query with filter one week:
{
"xhrStatus": "complete",
"request": {
"method": "POST",
"url": "api/datasources/proxy/1/_msearch",
"data": "{\"search_type\":\"query_then_fetch\",\"ignore_unavailable\":true,\"index\":[\"index-2019.06.07\",\"index-2019.06.08\",\"index-2019.06.09\",\"index-2019.06.10\",\"index-2019.06.11\",\"index-2019.06.12\",\"index-2019.06.13\",\"index-2019.06.14\"],\"max_concurrent_shard_requests\":\"256\"}\n{\"size\":0,\"query\":{\"bool\":{\"filter\":[{\"range\":{\"created\":{\"gte\":\"1559898820278\",\"lte\":\"1560503620278\",\"format\":\"epoch_millis\"}}},{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"org_system: (\\\"AY\\\" OR \\\"GA\\\" OR \\\"MS\\\" OR \\\"MV\\\" OR \\\"PM\\\" OR \\\"SZ\\\" OR \\\"TR\\\" OR \\\"VR\\\") AND status: (\\\"failed\\\" OR \\\"successful\\\") AND project: (\\\"VALUE1\\\" OR \\\"VALUE2\\\" OR \\\"VALUE3\\\" OR \\\"VALUE4\\\" OR \\\"VALUE5\\\" OR \\\"VALUE6\\\" OR \\\"VALUE7\\\" OR \\\"VALUE8\\\" OR \\\"VALUE9\\\" OR \\\"VALUE10\\\" OR \\\"VALUE11\\\" OR \\\"VALUE12\\\" OR \\\"VALUE13\\\") AND env: (\\\"env3\\\" OR \\\"env4\\\" OR \\\"env2\\\" OR \\\"env1\\\")\"}}]}},\"aggs\":{\"4\":{\"terms\":{\"field\":\"env.keyword\",\"size\":10,\"order\":{\"_key\":\"desc\"},\"min_doc_count\":1},\"aggs\":{\"3\":{\"terms\":{\"field\":\"status.keyword\",\"size\":10,\"order\":{\"_key\":\"desc\"},\"min_doc_count\":1},\"aggs\":{\"2\":{\"date_histogram\":{\"interval\":\"6h\",\"field\":\"created\",\"min_doc_count\":0,\"extended_bounds\":{\"min\":\"1559898820278\",\"max\":\"1560503620278\"},\"format\":\"epoch_millis\"},\"aggs\":{}}}}}}}}\n"
},
and this for today with filter:
{
"xhrStatus": "complete",
"request": {
"method": "POST",
"url": "api/datasources/proxy/1/_msearch",
"data": "{\"search_type\":\"query_then_fetch\",\"ignore_unavailable\":true,\"index\":[\"index-2019.06.13\",\"index-2019.06.14\"],\"max_concurrent_shard_requests\":\"256\"}\n{\"size\":0,\"query\":{\"bool\":{\"filter\":[{\"range\":{\"created\":{\"gte\":\"1560463200000\",\"lte\":\"1560549599999\",\"format\":\"epoch_millis\"}}},{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"org_system: __empty__ AND status: __empty__ AND project: __empty__ AND env: __empty__\"}}]}},\"aggs\":{\"4\":{\"terms\":{\"field\":\"env.keyword\",\"size\":10,\"order\":{\"_key\":\"desc\"},\"min_doc_count\":1},\"aggs\":{\"3\":{\"terms\":{\"field\":\"status.keyword\",\"size\":10,\"order\":{\"_key\":\"desc\"},\"min_doc_count\":1},\"aggs\":{\"2\":{\"date_histogram\":{\"interval\":\"1h\",\"field\":\"created\",\"min_doc_count\":0,\"extended_bounds\":{\"min\":\"1560463200000\",\"max\":\"1560549599999\"},\"format\":\"epoch_millis\"},\"aggs\":{}}}}}}}}\n"
},
Datasource
Thanks