Versions -
2.3 ( AWS Opensearch )
We use logstash to send data .
Describe the issue -
I am fairly new to Opensearch dashboards although we have been collecting logs for a while there and have no issues seeing data in the Discover section.
Recently I created a couple of new dashboards 3 days ago - a data table with metrics ( min/max ) on a specific timetaken.millseconds field - which is new but based on an existing timetaken field. I created that timetaken.milliseconds field using a REST call .
Everything was working for a couple of days and I could see all the metrics but for some reason it has stopped showing me anything for today.
If I search back to 3 days ago - I see metrics for those days but just not anything recent from today.
Any ideas on where to look to troubleshoot this?
Thanks , I saw regular data but just not in that newly created field in the visualization - it stopped showing anything after 2 days.
Originally I had a field called timecreated , but it was in string format and I needed it as integer- I followed some recommendation to manually create another field in the index with the correct datatype - called timecreated.(somename) . I called it timecreated.ms - and it was supposed to just be a copy of that original field. This actually worked for a couple of days - and I could see data correctly in timecreated.ms but I guess maybe it does not persist- not sure .
I ended up resolving it by creating another new field and updating the Logstash grok to send data to that specific field . Maybe I did something incorrect following the first recommendation but anyway its working correctly now !