Missing results from indexes with different settings

[robn]

Here's a bog-standard histogram of a logstash-style index showing the last two days:

Here's the same showing the last 24 hours.

See that big gap of nothing? That corresponds to a single day's index where I had done two things to the mapping:

• enabled compression on the _source field: "_source": { "compress": true }
• disabled the _all field: "_all" : { "enabled" : false }

I reverted that for today's index, and its all back to normal.

My suspicion is that either Kibana or Elasticsearch is reading the mapping for the first index in the series, and assuming that it applies to all indices in the current time range. I don't know enough to prove that either way.

I'm not even sure that this is necessarily a bug. The argument could be made that you can't expect consistent results from a search of multiple indices with different mappings. I think I'd accept that. But I still wanted to make sure it was reported in case there's actually a problem here.

[rashidkpc]

If you disabled the _all field without specifying a new default_field, and you didn't specify q specific field in your query, you will get no results as Elasticsearch doesn't know where to look.