Create a scripted field based on each nested field

Elastic Stack Kibana
1

I am indexing documents to my index as below:

"name": "test",
"version": 1,
"user": [
  {
    "created": 1548321909,
    "latest": false
  },
  {
    "created": 1548321916,
    "latest": false
  }

I am trying to create a scripted field based on the user.created nested field and convert it into Date data type. Currently, the user.created field data type is number

I would like the documents to look like this when they are ingested.

    "name": "test",
    "version": 1,
    "user": [
      {
        "created": 1548321909,
        "latest": false,
        "modified_date": <epoch time of created field converted to date format>
      },
      {
        "created": 1548321916,
        "latest": false,
        "modified_date": <epoch time of created field converted to date format>
      }

I'd really like to know if this can be done using scripted fields in Kibana ? If not using a scripted field is there any other possibility of achieving the desired outcome ?

2

Hi ben5556,

I don't think you're going to be able to convert those to dates with a scripted field. If it is possible, I think you would still have problems trying to use those date fields in Kibana. For example, I don't think you'd be able to use date fields in that user list for Date Histograms.

You might be able to define a mapping for your index so that those fields are treated as dates. But again, you're going to be limited in Kibana with what you can do with those dates.

I'm not sure what your data represents but you might want to consider flattening the object (probably only if there is some consistent number of these created fields) or creating multiple docs with a created date in each one.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.