Search code examples
elasticsearchkibanakibana-4

Timestamp not appearing in Kibana

I'm pretty new to Kibana and just set up an instance to look at some ElasticSearch data.

I have one index in Elastic Search, which has a few fields including _timestamp. When I go to the 'Discover' tab and look at my documents, each have the _timestamp field but with a yellow warning next to the field saying "No cached mapping for this field". As a result, I can't seem to sort/filter by time.

When I try and create a new index pattern and click on "Index contains time-based events", the 'Time-field name' dropdown doesn't contain anything.

Is there something else I need to do to get Kibana to recognise the _timestamp field?

I'm using Kibana 4.0.

Solution

  • You'll need to take these quick steps first :

    1. Go to Settings → Advanced.
    2. Edit the metaFields and add "_timestamp". Hit save.
    3. Now go back to Settings → Indices and _timestamp will be available in the drop-down list for "Time-field name".

    Kibana 4 Advanced Settings metaFields