Date_nano field is not considered as a time field in rollup

I have an index template with @timestamp field of type date_nano.
I can see this field in Discover, and it is treated as a normal time field, but when I want to create a rollup job for the index pattern that has this field, rollup interface in Kibana refuses this index pattern and shows an error message "Index pattern must match indices that contain time fields.".

When I have tried to create the same job using the API it worked and created the job. Is it a bug in the interface of Kibana or is it a limitation of using date_nano?

My index template looks like this:

PUT _index_template/somename-template
{
  "template": {
    "settings": {
      "index": {
        "lifecycle": {
          "name": "il-policy",
          "rollover_alias": "somename"
        },
        "number_of_shards": "5",
        "number_of_replicas": "1"
      }
    },
    "mappings": {
      "properties": {
        "host": {
          "type": "keyword"
        },
        "@timestamp": {
          "type": "date_nanos"
        },
        "number_of_users": {
          "type": "integer"
        }
      }
    }
  },
  "index_patterns": ["somename-*"]
}

And my roll up job looks like

PUT _rollup/job/somename-rollup
{
  "index_pattern": "somename-*",
  "rollup_index": "rollup-somename",
  "cron": "0 0 0 1 * ?",				
  "groups": { 
      "date_histogram": {
        "fixed_interval": "24h",
        "field": "@timestamp",
        "delay": "1d",
        "time_zone": "UTC"
      },
      "terms": {
        "fields": [
          "host"
        ]
      }
  },
      "metrics": [
        {
          "field": "number_of_users",
          "metrics": [
            "avg",
            "max",
            "min",
            "sum"
          ]
        }
      ],
  "page_size": 1000
}

It could be a problem with using date_nanos field type because when I used "date" it seems to be accepting it. Is that intentional or a bug?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.