时间戳数据未在kibana中显示

Question

I am sending syslog data to logstash, which applies some filtering and sends the data to elasticsearch. Even though I can see the data in elasticsearch, it is not being displayed in kibana.

When creating the index, if I set the Time Filter ( @timestamp ) the data is not visible. When using no Time Filter , the data is displayed perfectly. The mappings for the index look like this:

{
  "mapping": {
    "doc": {
      "properties": {
        "@timestamp": {
          "type": "date"
        },
        "facility": {
          "type": "text",
          "fields": {
            "keyword": {
              "type": "keyword",
              "ignore_above": 256
            }
          }
        },
        "facility_full": {
          "type": "text",
          "fields": {
            "keyword": {
              "type": "keyword",
              "ignore_above": 256
            }
          }
        },
        "facility_mnemonic": {
          "type": "text",
          "fields": {
            "keyword": {
              "type": "keyword",
              "ignore_above": 256
            }
          }
        },
        "host": {
          "type": "text",
          "fields": {
            "keyword": {
              "type": "keyword",
              "ignore_above": 256
            }
          }
        },
        "log_date": {
          "type": "text",
          "fields": {
            "keyword": {
              "type": "keyword",
              "ignore_above": 256
            }
          }
        },
        "log_sequence": {
          "type": "text",
          "fields": {
            "keyword": {
              "type": "keyword",
              "ignore_above": 256
            }
          }
        },
        "message": {
          "type": "text",
          "fields": {
            "keyword": {
              "type": "keyword",
              "ignore_above": 256
            }
          }
        },
        "severity_level": {
          "type": "text",
          "fields": {
            "keyword": {
              "type": "keyword",
              "ignore_above": 256
            }
          }
        },
        "tags": {
          "type": "text",
          "fields": {
            "keyword": {
              "type": "keyword",
              "ignore_above": 256
            }
          }
        },
        "type": {
          "type": "text",
          "fields": {
            "keyword": {
              "type": "keyword",
              "ignore_above": 256
            }
          }
        }
      }
    }
  }
}

So @timestamp is of type date - the same as all my other indices. What am I doing wrong?

Elasticstack v6.4.0

Answer 1

I cannot post a comment, so writing this as an answer here.

Please check with time filter for a bigger time range on your kibana(such as today or this month).
I see an issue with the timezone of the timestamp field(I could not see it in the mapping). Also, kibana works on UTC timezone by default. So, it will display data according to UTC (on your timestamp field).

Please check this link for more help.

Answer 2

Do you have an index pattern set up in Kibana defining this field as the date stamp? Without the index pattern the time selector on the dashboard will not do anything. See https://www.elastic.co/guide/en/kibana/current/tutorial-define-index.html