-
Notifications
You must be signed in to change notification settings - Fork 8.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Missing results from indexes with different settings #545
Comments
If you disabled the _all field without specifying a new default_field, and you didn't specify q specific field in your query, you will get no results as Elasticsearch doesn't know where to look. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Here's a bog-standard histogram of a logstash-style index showing the last two days:
Here's the same showing the last 24 hours.
See that big gap of nothing? That corresponds to a single day's index where I had done two things to the mapping:
_source
field:"_source": { "compress": true }
_all
field:"_all" : { "enabled" : false }
I reverted that for today's index, and its all back to normal.
My suspicion is that either Kibana or Elasticsearch is reading the mapping for the first index in the series, and assuming that it applies to all indices in the current time range. I don't know enough to prove that either way.
I'm not even sure that this is necessarily a bug. The argument could be made that you can't expect consistent results from a search of multiple indices with different mappings. I think I'd accept that. But I still wanted to make sure it was reported in case there's actually a problem here.
The text was updated successfully, but these errors were encountered: