Search code examples
elasticsearchkibanakibana-5

Time-field name other than @timestamp does not work

When I create an index in Kibana 5.0.0 and use @timestamp, I can create charts without any issue. However, if I select mydatefield (which is date type instead of @timestamp when creating an index, I cannot later create any chart. It says "No data" or something like this. What might be the reason? I uploaded data from CSV into Elasticsearch and specified datefield as follows:

mutate {
    add_field => {
        "mydatefield" => "%{mydatefield}"
        }
    }
    date
    {
    match => [ "mydatefield", "YYYY-MM-dd HH:mm:ss.SSS"]
    target => "mydatefield"
    }
Solution

  • You need to check the following:

    1)GET /_search { "query": { "exists" : { "field" : "yourTimeField" } } }

    If you get 0 result mean that all the documents with null value in this field. If you get more that 0 result, check that the date is valid.

    2)In kibana visualisation check that the time picker is set to the range of all your index