Aggregation using part of a timestamp field

[mo-ezzat (Mohammed Ezzat)]

Hello,
I'm trying to make an aggregation using a field in the a timestamp format as

"dateTimeReceived" : "2022-04-04T08:35:50.5566113Z"

but I just want to use the date part, so I tried using the visualization on kibana and sat the field as following

and got that

but I wanted to use date only and exclude the time, for example group all that took place in april 12 2022 together
I tried the Date Histogram but what I got was totally wrong, for some reason all the date was converted into one

I tried different min intervals, but all the same

any help with that?
thank you

[majagrubic (Maja)]

Hi, I suggest you define a runtime field that would contain just the date (or month) portion of your timestamp. You can do that by going to Data Views, select your desired data view, click "Add Field" and then define a script for the new field value.
Eg. to get the month, you would write something like this:
emit(doc['dateTimeReceived'].value.getMonthValue());

Then you can use this field in aggregations as a regular field.

[mo-ezzat (Mohammed Ezzat)]

Thanks for your answer, I tried what you proposed and it worked fine
I found value.toLocalDate() to get the entire date, but am having hard time finding a type for it

"runtime_mappings": {
"dateReceived": {
"type": ???,
 "script": {
 "source": "emit(doc['dateTimeReceived'].value.toLocalDate());"
 }

I've tried keyword, but it isn't acceptable, any idea about that?

"class_cast_exception: Cannot cast java.time.LocalDate to java.lang.String"

thank you

[majagrubic (Maja)]

You'll need to call toString() on it to make it a text field.

[mo-ezzat (Mohammed Ezzat)]

Thanks a lot, that did it
have a great day there