Graylog2 / Graylog2/graylog2-server
Index is incorrectly included in the search target when it contains a document with timestamp "1970-01-01 00:00:00.000"
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
I'll try to write this #6014 in a more simple and explicit way to you.
Index is **INCORRECTLY** included in the search target when it contains a document with timestamp "1970-01-01 00:00:00.000"
## Expected Behavior
Indices should be included according to their timeranges
## Current Behavior
Index is **INCORRECTLY** included in the search target when it contains a document with timestamp "1970-01-01 00:00:00.000"
## Steps to Reproduce (for bugs)
1. Select an index which you would like to use to trigger this bug (I chose index named beats_90days_2 in my test environment).
2. Search for logs that are **OUTSIDE** that indices time range (I'm using last 5 minutes, and to be clear I'm are talking about 16th of June 2019 which is **NOT** in the 1970s and it is **NOT** "11 days ago")
3. Indices are targeted **CORRECTLY**, beats_90days_2 is **NOT** in the target indices list
4. Add a document using timestamp "1970-01-01 00:00:00.000" to selected index (code snippet below)
5. Recalculate selected index's timerange
6. Search for logs that are **OUTSIDE** that indices time range
7. Indices are targeted **INCORRECTLY**, beats_90days_2 **IS** in the target indices list



```
curl -X POST "localhost:9200/beats_90days_2/message/" -H 'Content-Type: application/json' -d'
{
"timestamp" : "1970-01-01 00:00:00.000",
"message" : "triggering a bug"
}'
```



## Context
Because of this issue, a misinterpreted timestamp in a single document caused an index to be included in **EVERY** search. That index had incorrect datatype. And because of that incorrect datatype the Field statistics functions were broken.
## Your Environment
* Graylog Version: 3.0.1
* Elasticsearch Version: 6.7.2
* MongoDB Version: 4.0.7
* Operating System: CentOS 7
* Browser version: Safari
Contributor guide
Assessment
This issue has not been assessed yet.