Search code examples
elasticsearchkibanaelasticsearch-7

ElasticSearch / Kibana timestamp - field or _source?

My single raw document in ES/Kibana looks like this:

{
  "_index": "fluentd.apache.access.20191202",
  "_type": "_doc",
  "_id": "8jql724B3OrCHx56JnWb",
  "_score": 1,
  "_source": {
    "serveraddress": "....",
    "clientaddress": "...",
    "@timestamp": "2019-12-02T11:00:30+0000",
    "method": "GET",
    "url": "....",
    "status": 200,
    "bytes": 19820,
    "referrer": "....",
    "agent": "...",
    "@log_name": "apache.access"
  },
  "fields": {
    "@timestamp": [
      "2019-12-02T11:00:30.000Z"
    ]
  }
}

Why do the @timestamps differ regarding their format?

2019-12-02T11:00:30+0000 (UTC timezone, no milliseconds)
2019-12-02T11:00:30.000Z (milliseconds + "Z" for UTC timezone)

What does my index mapping have to look like to have the time quickfilter available in Discover?

Currently it looks like this and it doesn't show me the timespan quickfilter:

...,
"@timestamp": {
  "type": "date",
  "format": "yyyy-MM-dd'T'HH:mm:ssZ"
},
...

Index pattern:

enter image description here

enter image description here

Solution

  • You need to recreate the index pattern and make sure to select the @timestamp field as THE time field for that index pattern.

    That's the field Kibana uses for selecting documents based on the time selected int he time picker.