Surrounding Documents Broken in 6.4 (parse_exception)

[cawoodm]

Kibana version:
6.4

Elasticsearch version:
6.4

Server OS version:
Windows Server 2012

Browser version:
Chrome latest

Browser OS version:
Windows 10

Original install method (e.g. download page, yum, from source, etc.):
Download page

Describe the bug:
Since upgrading from ELK 6.3 to 6.4 the surrounding documents feature is broken (see screenshot).

Steps to reproduce:

1. Click "Surrounding Documents" on any document in any index

Request to Elasticsearch failed: {"error":{"root_cause":[{"type":"parse_exception","reason":"failed to parse date field 1536029868091 with format date_time"}],"type":"search_phase_execution_exception","reason":"all shards failed","phase":"query","grouped":true,"failed_shards":[{"shard":0,"index":"logs-prod3","node":"6tgOP8JVSmai0c0uR_Co7g","reason":{"type":"parse_exception","reason":"failed to parse date field 1536029868091 with format date_time","caused_by":{"type":"illegal_argument_exception","reason":"Parse failure at index 9 of 1536029868091"}}}]},"status":400}

[2018-09-04T15:03:15,748][DEBUG][o.e.a.s.TransportSearchAction] [ecom-app02-test] All shards failed for phase: [query]
org.elasticsearch.ElasticsearchParseException: failed to parse date field [1535968249943] with format [date_time]
	at org.elasticsearch.common.joda.DateMathParser.parseDateTime(DateMathParser.java:213) ~[elasticsearch-6.4.0.jar:6.4.0]
	at org.elasticsearch.common.joda.DateMathParser.parse(DateMathParser.java:66) ~[elasticsearch-6.4.0.jar:6.4.0]
	at org.elasticsearch.index.mapper.DateFieldMapper$DateFieldType.parseToMilliseconds(DateFieldMapper.java:318) ~[elasticsearch-6.4.0.jar:6.4.0]
	at org.elasticsearch.index.mapper.DateFieldMapper$DateFieldType.isFieldWithinQuery(DateFieldMapper.java:331) ~[elasticsearch-6.4.0.jar:6.4.0]
	at org.elasticsearch.index.query.RangeQueryBuilder.getRelation(RangeQueryBuilder.java:459) ~[elasticsearch-6.4.0.jar:6.4.0]
	at org.elasticsearch.index.query.RangeQueryBuilder.doRewrite(RangeQueryBuilder.java:466) ~[elasticsearch-6.4.0.jar:6.4.0]
	at org.elasticsearch.index.query.AbstractQueryBuilder.rewrite(AbstractQueryBuilder.java:269) ~[elasticsearch-6.4.0.jar:6.4.0]
	at org.elasticsearch.index.query.ConstantScoreQueryBuilder.doRewrite(ConstantScoreQueryBuilder.java:157) ~[elasticsearch-6.4.0.jar:6.4.0]
	at org.elasticsearch.index.query.AbstractQueryBuilder.rewrite(AbstractQueryBuilder.java:269) ~[elasticsearch-6.4.0.jar:6.4.0]
	at org.elasticsearch.index.query.BoolQueryBuilder.rewriteClauses(BoolQueryBuilder.java:474) ~[elasticsearch-6.4.0.jar:6.4.0]
	at org.elasticsearch.index.query.BoolQueryBuilder.doRewrite(BoolQueryBuilder.java:439) ~[elasticsearch-6.4.0.jar:6.4.0]
	at org.elasticsearch.index.query.AbstractQueryBuilder.rewrite(AbstractQueryBuilder.java:269) ~[elasticsearch-6.4.0.jar:6.4.0]
	at org.elasticsearch.search.builder.SearchSourceBuilder.rewrite(SearchSourceBuilder.java:921) ~[elasticsearch-6.4.0.jar:6.4.0]
	at org.elasticsearch.search.builder.SearchSourceBuilder.rewrite(SearchSourceBuilder.java:80) ~[elasticsearch-6.4.0.jar:6.4.0]
	at org.elasticsearch.index.query.Rewriteable.rewrite(Rewriteable.java:68) ~[elasticsearch-6.4.0.jar:6.4.0]
	at org.elasticsearch.index.query.Rewriteable.rewrite(Rewriteable.java:51) ~[elasticsearch-6.4.0.jar:6.4.0]
	at org.elasticsearch.search.internal.ShardSearchLocalRequest$RequestRewritable.rewrite(ShardSearchLocalRequest.java:307) ~[elasticsearch-6.4.0.jar:6.4.0]
	at org.elasticsearch.search.internal.ShardSearchLocalRequest$RequestRewritable.rewrite(ShardSearchLocalRequest.java:297) ~[elasticsearch-6.4.0.jar:6.4.0]
	at org.elasticsearch.index.query.Rewriteable.rewrite(Rewriteable.java:68) ~[elasticsearch-6.4.0.jar:6.4.0]
	at org.elasticsearch.search.SearchService.createSearchContext(SearchService.java:627) ~[elasticsearch-6.4.0.jar:6.4.0]
	at org.elasticsearch.search.SearchService.createSearchContext(SearchService.java:607) ~[elasticsearch-6.4.0.jar:6.4.0]
	at org.elasticsearch.search.SearchService.createContext(SearchService.java:569) ~[elasticsearch-6.4.0.jar:6.4.0]
	at org.elasticsearch.search.SearchService.createAndPutContext(SearchService.java:551) ~[elasticsearch-6.4.0.jar:6.4.0]
	at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:347) ~[elasticsearch-6.4.0.jar:6.4.0]
	at org.elasticsearch.search.SearchService$2.onResponse(SearchService.java:333) [elasticsearch-6.4.0.jar:6.4.0]
	at org.elasticsearch.search.SearchService$2.onResponse(SearchService.java:329) [elasticsearch-6.4.0.jar:6.4.0]
	at org.elasticsearch.search.SearchService$3.doRun(SearchService.java:1019) [elasticsearch-6.4.0.jar:6.4.0]
	at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:723) [elasticsearch-6.4.0.jar:6.4.0]
	at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) [elasticsearch-6.4.0.jar:6.4.0]
	at org.elasticsearch.common.util.concurrent.TimedRunnable.doRun(TimedRunnable.java:41) [elasticsearch-6.4.0.jar:6.4.0]
	at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) [elasticsearch-6.4.0.jar:6.4.0]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [?:1.8.0_45]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [?:1.8.0_45]
	at java.lang.Thread.run(Thread.java:745) [?:1.8.0_45]
Caused by: java.lang.IllegalArgumentException: Parse failure at index [9] of [1535968249943]

[cawoodm]

According to Epoch Converter the date 1535968249943 is Monday, September 3, 2018 9:50:49.943 AM (GMT)

[Bargs]

Should be fixed by #22684

If you need a workaround in the meantime, changing your date field mapping format to date_time||epoch_millis should get rid of the error.

[cawoodm]

Thanks, that fixed it for us!