Browse Source

Search-Troubleshoot | Most Recent Record (#94409)

May we add a section to [this page](https://www.elastic.co/guide/en/elasticsearch/reference/master/troubleshooting-searches.html#troubleshooting-check-field-values) to query for the latest record on an index (pattern)? This will be helpful to decide between Kibana Discover filter and Elasticsearch ingest lag problems.

---------

Co-authored-by: David Kilfoyle <41695641+kilfoyle@users.noreply.github.com>
Co-authored-by: Abdon Pijpelink <abdon.pijpelink@elastic.co>
Stef Nestor 2 years ago
parent
commit
e12e83fa37
1 changed files with 18 additions and 0 deletions
  1. 18 0
      docs/reference/troubleshooting/troubleshooting-searches.asciidoc

+ 18 - 0
docs/reference/troubleshooting/troubleshooting-searches.asciidoc

@@ -65,6 +65,9 @@ PUT my-index-000001
 {
   "mappings": {
     "properties": {
+      "@timestamp": {
+        "type": "date"
+      },
       "my-field": {
         "type": "keyword"
       },
@@ -224,6 +227,21 @@ GET my-index-000001/_search?filter_path=aggregations
 If the field does not return any values, check the data ingestion process. The
 field may have a different name.
 
+[discrete]
+[[troubleshooting-searches-latest-data]]
+=== Check the latest value
+
+For time-series data, confirm there is non-filtered data within the attempted
+time range. For example, if you are trying to query the latest data for the
+`@timestamp` field, run the following to see if the max `@timestamp` falls
+within the attempted range:
+
+[source,console]
+----
+GET my-index-000001/_search?sort=@timestamp:desc&size=1
+----
+//TEST[continued]
+
 [discrete]
 [[troubleshooting-searches-validate-explain-profile]]
 === Validate, explain, and profile queries