[Issue]:

[stevhutc2016]

Type of issue

None

What documentation page is affected

https://www.elastic.co/docs/solutions/observability/logs/parse-route-logs#observability-parse-log-data-configure-a-data-stream-with-an-index-template

What happened?

Following this example as closely as possible, after the initial section which sets @timestamp, and after setting the index template and updating the pipeline - the _simulate call produces correct result, but the query call NEVER returns any hits.

First, create datastream with one document (creating NEW datastream to remove prior work)

POST logs-example2-default/_doc
{
"message": "2023-08-08T13:45:12.123Z WARN 192.168.1.101 Disk usage exceeds 90%."
}

I'd like to show the results, but it seems Chrome does not support copy/paste from the right-side pane.

Some bug in Chrome?

I'd use Firefox - but it has the bug of not recognizing elastic auth cookies now - so this is SOL

What are we supposed to do now?

Additional info

No response