Discover: failed to parse date field

Elastic Stack Kibana
1

I define in the mapping:

        "time" : {
           "type" : "date",
           "format" : "yyyy'M'MM"
        },

The field is a date, I can create time histograms. Things look fine in the visualizations, and I can also filter on date. The filter is:

 {   "range": {     "time": {       "format": "epoch_millis",       "gte": 1470002400000,       "lt": 1472680800000     }   } }

In the Discover section, this json also works. However, this lucene syntax throws an error:

time : [1470002400000 TO 1472680800000]

This lucene query works fine on indexes with a standard time format.
The issue is not a problem for me, because json works, but still looks like a bug in the Discover section to me. The error is:

Error: Request to Elasticsearch failed: {"error":{"root_cause":[{"type":"parse_exception","reason":"failed to parse date field [1470002400000] with format [yyyy'M'MM]"}],"type":"search_phase_execution_exception","reason":"all shards failed","phase":"query","grouped":true,"failed_shards":[{"shard":0,"index":"asylum_appl_monthly_","node":"XKPlioC4RVevWytyI-aGyQ","reason":{"type":"query_shard_exception","reason":"failed to create query: {\n  \"query_string\" : {\n    \"query\" : \"time : [1470002400000 TO 1472680800000]\",\n    \"fields\" : [ ],\n    \"use_dis_max\" : true,\n    \"tie_breaker\" : 0.0,\n    \"default_operator\" : \"or\",\n    \"auto_generate_phrase_queries\" : false,\n    \"max_determinized_states\" : 10000,\n    \"enable_position_increments\" : true,\n    \"fuzziness\" : \"AUTO\",\n    \"fuzzy_prefix_length\" : 0,\n    \"fuzzy_max_expansions\" : 50,\n    \"phrase_slop\" : 0,\n    \"analyze_wildcard\" : true,\n    \"escape\" : false,\n    \"split_on_whitespace\" : true,\n    \"boost\" : 1.0\n  }\n}","index_uuid":"w-LU7xwkTzmJyzekFUUPIg","index":"asylum_appl_monthly_","caused_by":{"type":"parse_exception","reason":"failed to parse date field [1470002400000] with format [yyyy'M'MM]","caused_by":{"type":"illegal_argument_exception","reason":"Parse failure at index [9] of [1470002400000]"}}}}]},"status":400}
KbnError@https://31ddbfabcd679aee43b4b24bd2a6f8c4.eu-west-1.aws.found.io:9243/bundles/commons.bundle.js?v=15523:92:13722
RequestFailure@https://31ddbfabcd679aee43b4b24bd2a6f8c4.eu-west-1.aws.found.io:9243/bundles/commons.bundle.js?v=15523:92:14531
https://31ddbfabcd679aee43b4b24bd2a6f8c4.eu-west-1.aws.found.io:9243/bundles/kibana.bundle.js?v=15523:229:30408
https://31ddbfabcd679aee43b4b24bd2a6f8c4.eu-west-1.aws.found.io:9243/bundles/commons.bundle.js?v=15523:91:17547
map@[native code]
map@https://31ddbfabcd679aee43b4b24bd2a6f8c4.eu-west-1.aws.found.io:9243/bundles/commons.bundle.js?v=15523:91:16870
processQueue@https://31ddbfabcd679aee43b4b24bd2a6f8c4.eu-west-1.aws.found.io:9243/bundles/commons.bundle.js?v=15523:38:23623
https://31ddbfabcd679aee43b4b24bd2a6f8c4.eu-west-1.aws.found.io:9243/bundles/commons.bundle.js?v=15523:38:23900
$digest@https://31ddbfabcd679aee43b4b24bd2a6f8c4.eu-west-1.aws.found.io:9243/bundles/commons.bundle.js?v=15523:39:2364
$apply@https://31ddbfabcd679aee43b4b24bd2a6f8c4.eu-west-1.aws.found.io:9243/bundles/commons.bundle.js?v=15523:39:5044
done@https://31ddbfabcd679aee43b4b24bd2a6f8c4.eu-west-1.aws.found.io:9243/bundles/commons.bundle.js?v=15523:37:25033
completeRequest@https://31ddbfabcd679aee43b4b24bd2a6f8c4.eu-west-1.aws.found.io:9243/bundles/commons.bundle.js?v=15523:37:28710
onload@https://31ddbfabcd679aee43b4b24bd2a6f8c4.eu-west-1.aws.found.io:9243/bundles/commons.bundle.js?v=15523:37:29649
2

I create a mapping like this;

PUT test6
{
   "mappings": {
     "test": {
       "properties": {
        "time" : {
           "type" : "date",
           "format" : "yyyy'M'MM"
        }
       }
     }
   }
 }

And created a few docs like this one;

POST test6/test
{
  "time":"2017M06",
  "value":"jun17"
}

I can seem them in Discover;

image
image.png1616×1007 72.4 KB

And I was able to add a filter in Discover using the same date format used to post the docs;

image
image.png1606×804 64.8 KB

And if I edit the DSL Query, I see the same format;

{
  "range": {
    "time": {
      "gte": "2017M07",
      "lt": "2017M09"
    }
  }
}

And I can also put this in the query bar time:["2017M08" TO "2017M09"]

So far, so good. But if I click on the + by a time value to add a filter I get this;

image
image.png1615×515 63.3 KB

And the query for that is;

{
  "query": {
    "match": {
      "time": {
        "query": 1501545600000,
        "type": "phrase"
      }
    }
  }
}

So I thought I would set the format for this time field in the index pattern to "YYYY'M'MM" so that it would show correctly in Discover, and might also fix this issue. But it's not treating the single-quoted 'M' as a string. I'll file a bug on that.

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.