Can't select timestamp field in Kibana

[arisbanach]

I noticed that Kibana only shows the first 45-ish date fields in an index pattern in the dropdown box when you're adding a new index pattern. However, my ES index has more than 45 date fields, and the one I need to set as the timestamp is not listed in the dropdown at all since the others are pushing it down.

How can I get around this?

[tsullivan (Tim Sullivan)]

Which version of Kibana are we talking about.

This screenshot shows the latest version, will this not show more than 45 fields if more than 45 fields are mapped as date?

[arisbanach]

Yes, correct. Version 6.0.1

[tsullivan (Tim Sullivan)]

Well, unfortunately it looks like is something that needs improvement in the Kibana code. Would you mind filing an issue about this? http://github.com/elastic/kibana/issues

If this is 100% blocking you, you can find the document in the .kibana index that represents your index pattern, and manually update the timeFieldName value:

[arisbanach]

Actually, I'm not 100% sure about this now. What I'm doing is using ElasticPress (a WordPress plugin which syncs WordPress with Elasticsearch) and when it originally created the index, the post_date field was recognized as a time format. Then I deleted the index and restarted ElasticPress's sync and I couldn't find the post_date field as an option in Kibana for a timestamp, and posted here. Now I realized that post_date is now a text field. Not sure why though.

I'll talk to ElasticPress about it since I'm guessing it's really that they aren't sending a mapping template when indexing.

[tsullivan (Tim Sullivan)]

@arisbanach

Then I deleted the index and restarted ElasticPress's sync and I couldn't find the post_date field as an option in Kibana for a timestamp, and posted here. Now I realized that post_date is now a text field.

Sounds like what happened is that ElasticPress set the mappings for the index at the time of creating the index [1], but didn't create an index template, or that the index template also got deleted somehow.

Take a look at the documentation for index templates - they will get your data mapped correctly for any newly created indices that match a pattern. In other words, any time you create a new wordpress-* index, the post_date fields will automatically get mapped as date.

Index templates | Elasticsearch Guide [8.11] | Elastic

Example, imagining that the ElasticPress indices have an index pattern of wordpress-*, and the documents have a type of doc:

PUT _template/elasticpress
{
  "index_patterns": ["wordpress-*"],
  "settings": {
    "number_of_shards": 1
  },
  "mappings": {
    "doc": {
      "properties": {
        "post_date": {
          "type": "date",
          "format": "EEE MMM dd HH:mm:ss Z YYYY"
        }
      }
    }
  }
}

[1] The first time but not the second time? Not sure, really