I noticed that Kibana only shows the first 45-ish date fields in an index pattern in the dropdown box when you're adding a new index pattern. However, my ES index has more than 45 date fields, and the one I need to set as the timestamp is not listed in the dropdown at all since the others are pushing it down.
How can I get around this?
Which version of Kibana are we talking about.
This screenshot shows the latest version, will this not show more than 45 fields if more than 45 fields are mapped as
Yes, correct. Version 6.0.1
Well, unfortunately it looks like is something that needs improvement in the Kibana code. Would you mind filing an issue about this? http://github.com/elastic/kibana/issues
If this is 100% blocking you, you can find the document in the
.kibana index that represents your index pattern, and manually update the
Actually, I'm not 100% sure about this now. What I'm doing is using ElasticPress (a WordPress plugin which syncs WordPress with Elasticsearch) and when it originally created the index, the
post_date field was recognized as a time format. Then I deleted the index and restarted ElasticPress's sync and I couldn't find the
post_date field as an option in Kibana for a timestamp, and posted here. Now I realized that
post_date is now a text field. Not sure why though.
I'll talk to ElasticPress about it since I'm guessing it's really that they aren't sending a mapping template when indexing.
Sounds like what happened is that ElasticPress set the mappings for the index at the time of creating the index , but didn't create an index template, or that the index template also got deleted somehow.
Take a look at the documentation for index templates - they will get your data mapped correctly for any newly created indices that match a pattern. In other words, any time you create a new
wordpress-* index, the
post_date fields will automatically get mapped as date.
Example, imagining that the ElasticPress indices have an index pattern of
wordpress-*, and the documents have a type of
"format": "EEE MMM dd HH:mm:ss Z YYYY"
 The first time but not the second time? Not sure, really
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.