2.3 ( AWS Opensearch )
We use logstash to send data .
Describe the issue -
I am fairly new to Opensearch dashboards although we have been collecting logs for a while there and have no issues seeing data in the Discover section.
Recently I created a couple of new dashboards 3 days ago - a data table with metrics ( min/max ) on a specific timetaken.millseconds field - which is new but based on an existing timetaken field. I created that timetaken.milliseconds field using a REST call .
Everything was working for a couple of days and I could see all the metrics but for some reason it has stopped showing me anything for today.
If I search back to 3 days ago - I see metrics for those days but just not anything recent from today.
Any ideas on where to look to troubleshoot this?
Relevant Logs or Screenshots:
@yasvish How did you deploy your cluster?
Do you see new data in the indices related to the configured visualisations?
Do you see any errors in the Logstash and OpenSearch logs?
Thanks , I saw regular data but just not in that newly created field in the visualization - it stopped showing anything after 2 days.
Originally I had a field called timecreated , but it was in string format and I needed it as integer- I followed some recommendation to manually create another field in the index with the correct datatype - called timecreated.(somename) . I called it timecreated.ms - and it was supposed to just be a copy of that original field. This actually worked for a couple of days - and I could see data correctly in timecreated.ms but I guess maybe it does not persist- not sure .
I ended up resolving it by creating another new field and updating the Logstash grok to send data to that specific field . Maybe I did something incorrect following the first recommendation but anyway its working correctly now !