CODEWITHSUNDEEP
elasticsearchkibana
sugunan
sugunan

Reputation: 4456

Kibana date filter is inactive for the index created by enrich processor

I have created new index by merging 2 indexes. This was done using enrich processor. The steps followed from following stack post Elasticsearch merge multiple indexes based on common field

This index have the merged data. But while using this data on Kibana visualization it doesn't allow to apply date filter. Date filter always show off.

What could be wrong on this? The steps are copied bellow for easiness.

PUT /_enrich/policy/user-policy { "match": { "indices": "db-poc-user", "match_field": "nic", "enrich_fields": ["fname", "lname"] } }

    POST /_enrich/policy/user-policy/_execute

    PUT /_ingest/pipeline/user_lookup
    {
      "description" : "Enriching user details with tracks",
      "processors" : [
        {
          "enrich" : {
            "policy_name": "user-policy",
            "field" : "nic",
            "target_field": "tmp",
            "max_matches": "1"
          }
        },
        {
          "script": {
            "if": "ctx.tmp != null",
            "source": "ctx.putAll(ctx.tmp); ctx.remove('tmp');"
          }
        },
        {
          "remove": {
            "field": ["@version", "@timestamp", "type"]
          }
        }
      ]
    }

    POST _reindex
    {
      "source": {
        "index": "db-poc-ceg"
      },
      "dest": {
        "index": "user_tracks",
        "pipeline": "user_lookup"
      }
    }

Upvotes: 0

Views: 189

Answers (1)

Jaycreation
Jaycreation

Reputation: 2089

You remove the @timestamp in your pipeline. By default it's the field used by kibana to map the context date range. You can

  1. remove @timestamp from the remove processor of your pipeline
  2. choose another date field as default date in your index Pattern of kibana

You should be able to use normal behaviors again

Upvotes: 1

Related Questions