Kibana有时会返回完全无关的结果

Question

我们正在使用Logstash，elasticsearch和kibana来处理和搜索我们的日志。

通常，我们搜索，Kibana将返回不包含搜索项目的结果。

例如，我们搜索确切的短语 - 这是查询

    curl -XGET 'http://logs.magick.nu/kibana2/logstash-2014.10.17,logstash-2014.10.16/_search?pretty' -d '{
  "query": {
    "filtered": {
      "query": {
        "bool": {
          "should": [
            {
              "query_string": {
                "query": "COND_30892c7a490e154e01490e2dcf7a0008(2)"
              }
            }
          ]
        }
      },
      "filter": {
        "bool": {
          "must": [
            {
              "range": {
                "@timestamp": {
                  "from": 1413471279957,
                  "to": 1413557679958
                }
              }
            }
          ]
        }
      }
    }
  },
  "highlight": {
    "fields": {},
    "fragment_size": 2147483647,
    "pre_tags": [
      "@start-highlight@"
    ],
    "post_tags": [
      "@end-highlight@"
    ]
  },
  "size": 500,
  "sort": [
    {
      "@timestamp": {
        "order": "desc",
        "ignore_unmapped": true
      }
    },
    {
      "@timestamp": {
        "order": "desc",
        "ignore_unmapped": true
          }
        }
      ]
    }'

Kibana将返回以下结果：

    {
  "_index": "logstash-2014.10.17",
  "_type": "app SwitchYard",
  "_id": "unti1lWJRTelQd4N5_LVjA",
  "_score": null,
  "_source": {
    "message": "2014/10/17 13:50:43,739 [com.domain.Connector.service.ent.BasicJMSTickListener] (NJ4X-63) Sending market info for product symbol to JMS topic. Broker Server: broker.Demo. Account Number: 1235. StrategyId: 4028e49447ac4296147af921d5f00b. OrderCount: 2",
    "@version": "1",
    "@timestamp": "2014-10-17T14:24:32.193Z",
    "type": "app SwitchYard",
    "tags": [
      "node"
    ],
    "domain": "trading1-magickdev.amakitu.com",
    "env": "DEV",
    "host": "nodelarge.amakitu.com",
    "path": "/var/lib/openshift/541723389821cc77c2000167/jbosseap/logs/server.log"
  },
  "sort": [
    1413555872193,
    1413555872193
  ]
}

这种情况发生了很多！

任何想法有什么不对？