存在文档和时间戳，但Kibana在“发现”选项卡中未显示任何结果

Question

我的弹性搜索引擎中有一些文档：

1. 在Kibana，我成功创建了一个索引模式，包括建议的时间字段。

2. 在过去5年中搜索文档时 - 找不到任何内容。

3. 如果我在没有时间字段的情况下创建索引模式 - 我可以看到所有文档。

4. 每个_source内容都有文档。

我真的很绝望，有人可以帮忙吗？

已编辑

映射：

{ "settings" : { "number_of_shards" : 1 }, "mappings" : { "monitor" : { "properties" : { "ProcessName": { "type": "string", "index": "analyzed" }, "OpName": { "type": "string", "index": "analyzed" }, "Domain": { "type": "string", "index": "not_analyzed" }, "TraceType": { "type": "string", "index": "not_analyzed" }, "TraceDateTime": { "type": "date", "format": "yyyy-MM-dd HH:mm:ss" }, "ApplicationCode": { "type": "string", "index": "not_analyzed" }, "SrcMessageID": { "type": "string", "index": "not_analyzed" }, "ProcessID": { "type": "string", "index": "not_analyzed" }, "OpID": {"type": "string", "index": "not_analyzed" }, "OpParentID": { "type": "string", "index": "not_analyzed" }, "HostName": { "type": "string", "index": "not_analyzed"} } } } }

文件示例：

{
        "_index": "monitors",
        "_type": "monitor",
        "_id": "AVPkvD3YnwEx8EXuppEN",
        "_score": 1,
        "_source": {
          "ProcessName": "myapp",
          "OpName": "myop",
          "Domain": "mydomain",
          "TraceType": "Info",
          "TraceDateTime": "2016-04-05 07:44:15",
          "ApplicationCode": "71",
          "SrcMessageID": "35e291e9-10ad-47a2-8ce8-935cebc62b26",
          "ProcessID": "a017afa9-c541-4424-bc63-c83a3d8830e0",
          "OpID": "84267eed-38db-4d84-88c4-f46d148e494a",
          "HostName": "myHost"
        }

已编辑2

{"index":[".kibana-devnull"],"ignore_unavailable":true}
{"size":500,"sort":[{"TraceDateTime":{"order":"desc","unmapped_type":"boolean"}}],"highlight":{"pre_tags":["@kibana-highlighted-field@"],"post_tags":["@/kibana-highlighted-field@"],"fields":{"*":{}},"require_field_match":false,"fragment_size":2147483647},"query":{"filtered":{"query":{"query_string":{"query":"*","analyze_wildcard":true}},"filter":{"bool":{"must":[{"range":{"TraceDateTime":{"gte":1301984031628,"lte":1459836831628,"format":"epoch_millis"}}}],"must_not":[]}}}},"aggs":{"2":{"date_histogram":{"field":"TraceDateTime","interval":"1M","time_zone":"Asia/Jerusalem","min_doc_count":0,"extended_bounds":{"min":1301984031627,"max":1459836831627}}}},"fields":["*","_source"],"script_fields":{},"fielddata_fields":["TraceDateTime"]}

Answer 1

Issue was that I'm sending date-time in +03:00 GMT, and date-time is stored in elasticsearch as UTC timezone.