This has come up from time to time, but I haven’t seen any definitive answers. Is it possible to have a time-only multi-field in a date time field? For example, created_date would be the full datetime, and created_date.time would store only the time portion, indexed for filtering/sorting/querying.
From what I’ve gathered, this might not be possible because datetimes are internally stored as milliseconds after epoch. Would there be some way to store the modulo of the milliseconds at indexing time to remove the days from them, and then use that value for range filtering?
No that is not supported / that is not how multifields work... See here
It is often useful to index the same field in different ways for different purposes. This is the purpose of multi-fields . For instance, a string field could be mapped as a text field for full-text search, and as a keyword field for sorting or aggregations:
you will need to use 2 separate fields like
created_date
created_time_of_day
Yes you would do this at index time using. an ingest pipeline with a script processor... but the result would be a long
I think I showed just how to do something similar recently as a runtime field a script processor would be very similar
This would actually create a "keyword" that shows the time of day it could be filtered...
If you just want ms, that would be a long, and of course, that would not be a date. It would just be a long...
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.