I have a
time field in my document which is a timestamp number. It is not set as a
date type field so cannot use it in the date range bucket aggregation directly (Kibana complains that the index does not contain any compatible field types: date).
My idea was so create a scripted field e.g.
parsed_date with type
date on the same index and return a
Date object based on the timestamp. I've managed to add it with painless script as following:
return new Date(doc["time"].value * 1000);
So far all good, the timestamp is parsed properly and on the preview, I can see that my new field is returned:
The issue is that the scripted field is always returned as an array hence the result I get is:
"parsed_date": [ "2020-11-19T00:00:00.000Z" ]
I've found this brief explanation of why is it so: Script_fields always returns array. how to return an object or simple data type? and it does make sense to me.
Now when I try to use that new scripted field in a date range agg. I get 500 error with the error message:
Unsupported script value [Tue Nov 17 00:00:00 UTC 2020], expected a number, date, or boolean
This again makes sense as this date object is within array but not sure how I can overcome this, as I understand it, date range agg. expects object not array but seems I cannot achieve this with scripted fields.
Any hints would be much appreciated, thanks!