Error filtering by date type


(Allee) #1

I've attempted various date formats such as (2018-05-29 00:00:00, 2018-05-29, 2018-05-29Y00:00:00.000Z). When I select the filter option after viewing a document I receive the parsing error below. The field is being formatted in Kibana correctly after indexing in Elasticsearch, but still unable to filter the date type. Any ideas would help.



(Tyler Smalley) #2

What version of Kibana is this? Can you provide the mapping for this index?

Console Example: GET /my-index/_mapping


(Allee) #3

Kibana version is 6.3.1

Here is a mapping where I specified the format. I had to add the malformed field bc even when I index using the correct format, the entire document would get rejected.

{
"mapping": {
"doc": {
"properties": {
"AssignedTo": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"Assigned": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"AssignemtGroup": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"Duration": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"Serivice": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"CalendarDuration": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"Category": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"Closed": {
"type": "date",
"ignore_malformed": true,
"null_value": "null",
"format": "yyyy-MM-dd HH:mm:ss"
},
"ClosedBy": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"ClosedByID": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"ClosedCode": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"ClosedNotes": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"ContactType": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"Impacting": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"Related": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"Description": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"Lv2": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"Function": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"Impact": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"UnqiueID": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"ResolvedTime": {
"type": "date",
"ignore_malformed": true,
"null_value": "null",
"format": "yyyy-MM-dd HH:mm:ss"
},
"StartTime": {
"type": "date",
"ignore_malformed": true,
"null_value": "null",
"format": "yyyy-MM-dd HH:mm:ss"
},
"Status": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"Location": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"LocationType": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"Resolution": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"OpenByID": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"Opened": {
"type": "date",
"ignore_malformed": true,
"null_value": "null",
"format": "yyyy-MM-dd HH:mm:ss"
},
"OpenedBy": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"ShortDescription": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"Situation": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
}
}
}


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.