# Problem query Graylog’s Elasticsearch with Grafana

**URL:** <https://community.graylog.org/t/problem-query-graylog-s-elasticsearch-with-grafana/1797>\
**Category:** Graylog Central (peer support)\
**Created:** [July 20, 2017, 2:34pm UTC](https://community.graylog.org/t/problem-query-graylog-s-elasticsearch-with-grafana/1797 "2017-07-20T14:34:54Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![LeDistordu](https://avatars.discourse-cdn.com/v4/letter/l/ee59a6/32.png) [@LeDistordu](https://community.graylog.org/u/LeDistordu)\
**Post date:** [July 20, 2017, 2:34pm UTC](https://community.graylog.org/t/problem-query-graylog-s-elasticsearch-with-grafana/1797/1 "2017-07-20T14:34:54Z")

</div>

I have graylog (2.2.3) and i want query its elasticsearch (2.4.4).

I add datasource elasticsearch 2x, i can query but when i query i dont have the same amount of data :

With same query on 5 minutes  
From Graylog : 8796 data returned  
From Grafana : 57 data returned

Grafana datasource configuration :  
Index name : graylog\*  
Timestamp field name : timestamp  
Pattern : no pattern  
Version : 2.x

Why do not I get the same results?

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [July 20, 2017, 2:43pm UTC](https://community.graylog.org/t/problem-query-graylog-s-elasticsearch-with-grafana/1797/2 "2017-07-20T14:43:56Z")

</div>

What query are you running exactly?  
Which indices does Grafana use and which indices does Graylog use for the same query?

---

<div class="post-metadata">

**Author:** ![LeDistordu](https://avatars.discourse-cdn.com/v4/letter/l/ee59a6/32.png) [@LeDistordu](https://community.graylog.org/u/LeDistordu)\
**Post date:** [July 20, 2017, 3:04pm UTC](https://community.graylog.org/t/problem-query-graylog-s-elasticsearch-with-grafana/1797/3 "2017-07-20T15:04:23Z")

</div>

Graylog :

```auto
{
  "from": 0,
  "size": 150,
  "query": {
    "bool": {
      "must": {
        "query_string": {
          "query": "\"myrouter\" AND (\"990-D\" OR \"991-D\" OR \"default-D\")",
          "allow_leading_wildcard": true
        }
      },
      "filter": {
        "bool": {
          "must": {
            "range": {
              "timestamp": {
                "from": "2017-07-20 13:37:51.507",
                "to": "2017-07-20 13:42:51.507",
                "include_lower": true,
                "include_upper": true
              }
            }
          }
        }
      }
    }
  },
  "sort": [
    {
      "timestamp": {
        "order": "desc"
      }
    }
  ],
  "highlight": {
    "require_field_match": false,
    "fields": {
      "*": {
        "fragment_size": 0,
        "number_of_fragments": 0
      }
    }
  }
} 

```

Grafana :

```auto
     {“search_type”:“count”,“ignore_unavailable”:true,“index”:“graylog*”}
    {“size”:0,“query”:{“bool”:{“filter”:[{“range”:{“timestamp”:{“gte”:“1500557461375”,“lte”:“1500557761375”,“format”:“epoch_millis”}}},{“query_string”:{“analyze_wildcard”:true,“query”:"“myrouter” AND (“990-D” OR “991-D” OR “default-D”)"}}]}},“aggs”:{“2”:{“date_histogram”:{“interval”:“2s”,“field”:“timestamp”,“min_doc_count”:0,“extended_bounds”:{“min”:“1500557461375”,“max”:“1500557761375”},“format”:“epoch_millis”},“aggs”:{}}}}

```

---

<div class="post-metadata">

**Author:** ![LeDistordu](https://avatars.discourse-cdn.com/v4/letter/l/ee59a6/32.png) [@LeDistordu](https://community.graylog.org/u/LeDistordu)\
**Post date:** [July 20, 2017, 3:34pm UTC](https://community.graylog.org/t/problem-query-graylog-s-elasticsearch-with-grafana/1797/4 "2017-07-20T15:34:20Z")

</div>

Indice on graylog :  
graylog2\_25  
graylog2\_24  
graylog\_docker\_1  
graylog\_vyos\_rt01\_0  
graylog\_docker\_2  
graylog\_vyos\_rt01\_1  
graylog2\_23  
graylog2\_22  
graylog2\_21

Indice for grafana data source : graylog\*

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [July 20, 2017, 3:55pm UTC](https://community.graylog.org/t/problem-query-graylog-s-elasticsearch-with-grafana/1797/5 "2017-07-20T15:55:17Z")

</div>

Try using the exact same query in Grafana that has been generated by Graylog.

Other than that, I suggest asking the Grafana community since this isn’t exactly an issue with Graylog.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [August 3, 2017, 3:55pm UTC](https://community.graylog.org/t/problem-query-graylog-s-elasticsearch-with-grafana/1797/6 "2017-08-03T15:55:46Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.