Display date without time in Elasticsearch

Elastic Stack Kibana
1

Hi,
I have the following input in a "Date" field:
Date=2020.11.12

Currently, it's displaying as this in Kibana:
Date Nov 12, 2020 @ 00:00:00.000

I would like to display this as is in Kibana, i.e., Date: 2020.11.12. How do I do that? I want to use the yyyy.MM.dd format and without the timestamp. Can I modify the date field to do this?

This is what I have in the Index Template Mapping:
"Date": {
"format": "strict_date_optional_time||epoch_millis||yyyy.MM.dd",
"index": true,
"ignore_malformed": false,
"store": false,
"type": "date",
"doc_values": true
}

This is what I have in the logstash config file:
input {
udp { port => 1001 id => "syslog_id" buffer_size => 196608 receive_buffer_bytes => 196608 }
}
filter {
if [message] =~ /InbTxnType/ {
mutate { add_tag => ["TRANSACTION", "SUMMARY"] }
kv { trim_key => " " trim_value => " " source => "logMessage" value_split => "=" field_split => "," }
date { match => ["Date","yyyy.MM.dd"] target => "Date" }
}
}

output {
if "SUMMARY" in [tags] {
elasticsearch{ hosts => ["elasticsearch-client:80"] index => "summary-transaction-%{+YYYY.MM}" }
}
}

Thanks!
Vanessa

2

Hello @VeeT

Have you tried using a field formatter? https://www.elastic.co/guide/en/kibana/current/managing-fields.html

Thanks,
Matt

3

Hi Matt,
Yes, I've done that. I've set the date format )yyyy.MM.dd) in the index pattern. Please see attached.

Thanks!
Vee

Date_index_pattern
Date_index_pattern753×773 65.4 KB

4

@VeeT

Which version of the stack are you using? Can you show a screenshot where the data isn't formatted as desired?

5

Matt,
We are using ELK 7.6.
Here are the screenshots. The InputDate.png is the one that's being sent to us from the application thru Load Balancer to Logstash. The OutpuDate.png is the one that's being displayed in Kibana.

The desired result is "Date 2020.11.16".

Thanks!
Vee

InputDate:
InputDate

OutputDate:
OutputDate

6

Yes, I've done that. I've set the date format )yyyy.MM.dd) in the index pattern. Please see attached.

Thats not a screenshot from the index pattern field format editor. I suspect its an ingest related screenshot. Try going to Stack Management -> Index Patterns and set the formatting there.

Thanks,
Matt