Can't make data searchable when I include time

I'm really stuggling. My elasticsearch data and mapping is in this format:

Data

{
  "test" : [ {
    "data" : "119050300",
    "date" : "10:00 2019-06-03"
  } ]
}

Mapping

{
  "mappings": {
    "properties": {
      "date": {
        "type":   "date",
        "format": "HH:mm yyyy-MM-dd"
      },
        "data": {
        "type":   "integer"
      }
    }
  }
}

In Kibana I couldn't find this data, as the date didn't seem to appear even when I used the correct range. However, if I remove the time aspect and do this instead, it works fine:

Data

{
  "test" : [ {
    "data" : "119050300",
    "date" : "2019-06-03"
  } ]
}

Map

{
  "mappings": {
    "properties": {
      "date": {
        "type":   "date",
        "format": "yyyy-MM-dd"
      },
        "data": {
        "type":   "integer"
      }
    }
  }
}

Can someone please tell me how to include the time and not have it break.

Hi @Hiven it's a weird behaviour but before opening any issue I'd like to ask you few questions:

  • what is your Kibana version?
  • what do you mean by In Kibana I couldn't find this data? where are you looking for that data? Does it appear as part of the doc in the discover?

I've tried to replicate that issue but I don't see any error on that mapping. I'm using the following from the dev tools:

PUT test_index
{
  "mappings": {
    "properties": {
      "date": {
        "type":   "date",
        "format": "HH:mm yyyy-MM-dd"
      }
    }
  }
}
PUT test_index/_doc/1
{
  "date" : "10:00 2019-06-03"
}

PUT test_index/_doc/2
{
  "date" : "12:00 2019-06-03"
}

And those documents are easily visible from discovery

One last question: have you created an index-pattern on that index? it's required to be created for most of the application/visualization. Also remember to add that field as Time Filter field when creating the index pattern.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.