diff --git a/docs/reference/troubleshooting/troubleshooting-searches.asciidoc b/docs/reference/troubleshooting/troubleshooting-searches.asciidoc index 90a28058b6d62..76a403d3249d7 100644 --- a/docs/reference/troubleshooting/troubleshooting-searches.asciidoc +++ b/docs/reference/troubleshooting/troubleshooting-searches.asciidoc @@ -65,6 +65,9 @@ PUT my-index-000001 { "mappings": { "properties": { + "@timestamp": { + "type": "date" + }, "my-field": { "type": "keyword" }, @@ -224,6 +227,21 @@ GET my-index-000001/_search?filter_path=aggregations If the field does not return any values, check the data ingestion process. The field may have a different name. +[discrete] +[[troubleshooting-searches-latest-data]] +=== Check the latest value + +For time-series data, confirm there is non-filtered data within the attempted +time range. For example, if you are trying to query the latest data for the +`@timestamp` field, run the following to see if the max `@timestamp` falls +within the attempted range: + +[source,console] +---- +GET my-index-000001/_search?sort=@timestamp:desc&size=1 +---- +//TEST[continued] + [discrete] [[troubleshooting-searches-validate-explain-profile]] === Validate, explain, and profile queries