I'm attempting to index OpenTelemetry data that uses nanosecond epochs for span timings. I have the following contained in my index mappings (verified via GET /index/_mappings:
"startTimeUnixNano": {
"type": "date_nanos"
},
But when indexing a document with this value:
"startTimeUnixNano":1700860667233615872,
Elasticsearch throws an illegal_argument_exception:
{
"error":{
"root_cause":[
{
"type":"document_parsing_exception",
"reason":"[1:1723] failed to parse field [resourceSpans.scopeSpans.spans.startTimeUnixNano] of type [date_nanos] in document with id 'OMxXDowB4M_uH230iKzE'. Preview of field's value: '1700860667233615872'"
}
],
"type":"document_parsing_exception",
"reason":"[1:1723] failed to parse field [resourceSpans.scopeSpans.spans.startTimeUnixNano] of type [date_nanos] in document with id 'OMxXDowB4M_uH230iKzE'. Preview of field's value: '1700860667233615872'",
"caused_by":{
"type":"illegal_argument_exception",
"reason":"date[+53900098-12-02T05:46:55.872Z] is after 2262-04-11T23:47:16.854775807 and cannot be stored in nanosecond resolution"
}
},
"status":400
}
It's obviously accepting this huge timestamp value in a format with less precision than nanoseconds, since the date evaluated by Elasticsearch is so far into the future, but I've set the index mappings to date_nano so I don't know why I can't give it a nanosecond epoch.
I've confirmed the provided nanosecond timestamp is within range via (JavaScript):
new Date(1700860667233615872 / 1000000)
which gives Nov 24, 2023.
You also need to divide the value you send to ES by 1000000 like you did in your JS code, i.e. sending this will work and will have the correct resolution
"startTimeUnixNano": 1700860667233.615872,
This will resolve to
Friday, November 24, 2023 9:17:47.233615