Aggregation using part of a timestamp field

Hello,
I'm trying to make an aggregation using a field in the a timestamp format as

"dateTimeReceived" : "2022-04-04T08:35:50.5566113Z"

but I just want to use the date part, so I tried using the visualization on kibana and sat the field as following
image
and got that
image

but I wanted to use date only and exclude the time, for example group all that took place in april 12 2022 together
I tried the Date Histogram but what I got was totally wrong, for some reason all the date was converted into one


I tried different min intervals, but all the same

any help with that?
thank you

Hi, I suggest you define a runtime field that would contain just the date (or month) portion of your timestamp. You can do that by going to Data Views, select your desired data view, click "Add Field" and then define a script for the new field value.
Eg. to get the month, you would write something like this:
emit(doc['dateTimeReceived'].value.getMonthValue());

Then you can use this field in aggregations as a regular field.

Thanks for your answer, I tried what you proposed and it worked fine
I found value.toLocalDate() to get the entire date, but am having hard time finding a type for it

"runtime_mappings": {
"dateReceived": {
"type": ???,
 "script": {
 "source": "emit(doc['dateTimeReceived'].value.toLocalDate());"
 }

I've tried keyword, but it isn't acceptable, any idea about that?

"class_cast_exception: Cannot cast java.time.LocalDate to java.lang.String"

thank you

You'll need to call toString() on it to make it a text field.

1 Like

Thanks a lot, that did it
have a great day there