[7.5.1] script field issue on @timestamp

[dao (olivier hodac)]

Dear all,

I am trying to create a field in my index patter that will hold the date only. I was thinking about script fields.

I create a script field like this, as mentioned in https://www.elastic.co/guide/en/elasticsearch/painless/7.5/painless-datetime.html

String datetime = '1983-10-13T22:15:30Z';
ZonedDateTime zdt = ZonedDateTime.parse(datetime);
String ret = zdt.format(DateTimeFormatter.ISO_INSTANT);
return ret;

Works fine:

Now replacing the constant by the @timestamp:

String datetime = doc['@timestamp'].value;
ZonedDateTime zdt = ZonedDateTime.parse(datetime);
String ret = zdt.format(DateTimeFormatter.ISO_INSTANT);
return ret;

seems to fail:

What's wrong?

[ropc (Romain Chanu)]

Hi @dao - What is the type of @timestamp in your index?

[dao (olivier hodac)]

Yes there are documents. Here is the same preview with @timestamp as additional field, and a very simple script that works

[ropc (Romain Chanu)]

thanks @dao, can i confirm with you the type of @timestamp? is a date or string type?

[dao (olivier hodac)]

@timestamp is a date:

[ropc (Romain Chanu)]

If it is a date type, I would expect some exceptions/errors related to type conversion / cast.

Using this script in my environment:

String datetime = doc['@timestamp'].value;
ZonedDateTime zdt = ZonedDateTime.parse(datetime);
String ret = zdt.format(DateTimeFormatter.ISO_INSTANT);
return ret;

throws a class_cast_exception with the following reason Cannot cast org.elasticsearch.script.JodaCompatibleZonedDateTime to java.lang.String

You can refer to our documentation that gives example on how to use a Datetime Input From an Indexed Document.

For example:

ZonedDateTime input = doc['@timestamp'].value;
String output = input.format(DateTimeFormatter.ISO_INSTANT);
return output;

I hope that helps.

[dao (olivier hodac)]

@ropc

ZonedDateTime input = doc['@timestamp'].value; String output = input.format(DateTimeFormatter.ISO_INSTANT); return output;

Works fine, thank's

Did not find the that @timestamp is a ZonedDateTime in the documentation