ES 7.16 Rolling up multiple date fields

Elastic Stack Elasticsearch
1

Hello Team,

I'm currently working with rollup jobs in ES 7.16.2 and I'm looking to group on multiple date properties. It seems that this isn't currently possible with the API only supporting a single data_histogram field. It also seems that Date types aren't supported by other aggregations i.e. Histogram or Terms, with the outputted message:

{
  "error" : {
    "root_cause" : [
      {
        "type" : "illegal_argument_exception",
        "reason" : "Validation Failed: 1: The field referenced by a terms group must be a [numeric] or [keyword/text] type, but found [date] for field [document.date];"
      }
    ],
    "type" : "illegal_argument_exception",
    "reason" : "Validation Failed: 1: The field referenced by a terms group must be a [numeric] or [keyword/text] type, but found [date] for field [document.date];"
  },
  "status" : 400
}

We are currently planning to work around this limitation by also indexing the date property we care about as a long so that we can roll it up. For this particular property, the value of including it is primarily for queries rather than aggregations.

I have a few questions on this topic, firstly is my assertion about there being no way to rollup multiple dates properties correct? If so, is this addition on the roadmap for the rollup feature?

Is the approach I have outlined above of indexing the value with multiple types a sensible workaround for this problem? Might there be any other options we could consider?

Thanks!

2

As an update to this query, we took the approach of indexing the date as a numeric value representing epoch seconds using a terms aggregation. This allowed us to query/filter using a second date although we have to map from dates to epoch seconds when querying the index.

Hopefully this workaround might be useful for someone else. However allowing multiple dates to be indexed as date_histograms would still be valuable.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.