I have an index template with @timestamp field of type date_nano.
I can see this field in Discover, and it is treated as a normal time field, but when I want to create a rollup job for the index pattern that has this field, rollup interface in Kibana refuses this index pattern and shows an error message "Index pattern must match indices that contain time fields.".
When I have tried to create the same job using the API it worked and created the job. Is it a bug in the interface of Kibana or is it a limitation of using date_nano?
My index template looks like this:
PUT _index_template/somename-template
{
"template": {
"settings": {
"index": {
"lifecycle": {
"name": "il-policy",
"rollover_alias": "somename"
},
"number_of_shards": "5",
"number_of_replicas": "1"
}
},
"mappings": {
"properties": {
"host": {
"type": "keyword"
},
"@timestamp": {
"type": "date_nanos"
},
"number_of_users": {
"type": "integer"
}
}
}
},
"index_patterns": ["somename-*"]
}
And my roll up job looks like
PUT _rollup/job/somename-rollup
{
"index_pattern": "somename-*",
"rollup_index": "rollup-somename",
"cron": "0 0 0 1 * ?",
"groups": {
"date_histogram": {
"fixed_interval": "24h",
"field": "@timestamp",
"delay": "1d",
"time_zone": "UTC"
},
"terms": {
"fields": [
"host"
]
}
},
"metrics": [
{
"field": "number_of_users",
"metrics": [
"avg",
"max",
"min",
"sum"
]
}
],
"page_size": 1000
}