You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I reverted that for today's index, and its all back to normal.
My suspicion is that either Kibana or Elasticsearch is reading the mapping for the first index in the series, and assuming that it applies to all indices in the current time range. I don't know enough to prove that either way.
I'm not even sure that this is necessarily a bug. The argument could be made that you can't expect consistent results from a search of multiple indices with different mappings. I think I'd accept that. But I still wanted to make sure it was reported in case there's actually a problem here.
The text was updated successfully, but these errors were encountered:
If you disabled the _all field without specifying a new default_field, and you didn't specify q specific field in your query, you will get no results as Elasticsearch doesn't know where to look.
Here's a bog-standard histogram of a logstash-style index showing the last two days:
Here's the same showing the last 24 hours.
See that big gap of nothing? That corresponds to a single day's index where I had done two things to the mapping:
_source
field:"_source": { "compress": true }
_all
field:"_all" : { "enabled" : false }
I reverted that for today's index, and its all back to normal.
My suspicion is that either Kibana or Elasticsearch is reading the mapping for the first index in the series, and assuming that it applies to all indices in the current time range. I don't know enough to prove that either way.
I'm not even sure that this is necessarily a bug. The argument could be made that you can't expect consistent results from a search of multiple indices with different mappings. I think I'd accept that. But I still wanted to make sure it was reported in case there's actually a problem here.
The text was updated successfully, but these errors were encountered: