Hi, I want to configure the time field from a log entry. I have a param "date" in object message from json formatted as Kibana date "yyyy-mm-ddT:hh:mm:ss.sssZ" and also separated in the object tags. I would like charts and tables will use tags.date for drawing instead of _source.date.
This is a table entry, see tags.date is built from message. I can sort by my tag date:
{
"_index": "logs-xxxxxxx-2015.10.19",
"_type": "log",
"_id": "AVCAEy5v-ZsPos8fIh-J",
"_score": null,
"_source": {
"date": "2015-10-19T12:29:13.214Z",
"message": "2015/10/19 08:29:11 [event:xxxxxx][date:2015-10-19T08:29:11.324Z][user_id:xxxxx][country_code:xx][phone_number:xxxxxxxxx][flow_type:xxxx][flow_sub_type:xxxx][message:null]",
"tags": {
"app": "xxxxxxxxx",
"date": "2015-10-19t08:29:11.324z",
"serv": "webserver",
"phost": "xxxxxxx",
"datacenter": "xxxx",
"source": "xxxxxxxxxx",
"dept": "xxxx",
"message": "null",
"short_source": "mercury.log",
"flow_sub_type": "xxxxx",
"country_code": "xxxx",
"log_type": "application",
"flow_type": "xxxxxx",
"user_id": "xxxxxx",
"scope": "null",
"host": "xxxxxxx",
"phone_number": "xxxxx",
"persistent": "true",
"event": "xxxxxx",
"gav": "master"
}
},
"sort": [
"2015-10-19t08:29:11.324z"
]
}
.
.
But when I set the tags.date for a chart, it gets blank.
.
.
I also configured timepicker as tags.date in dashboard general configuration but it didn't work.
.
.
Unfortunately I don't have control of the interface which communicate my API with Kibana. I able to configure my api or kibana dashboard. Suggestions?
I apologise in advance if I have been unclear.
Thanks