ES Nest won't insert @timestamp


(Ian Cross) #1

Hi,

I am trying to insert a record into Elasticsearch using NEST. I need the timestamp to be indexed as "@timestamp" not "timestamp".

class Program
{


   /// <summary>
   /// 
   /// </summary>
   /// <param name="args"></param>
    static void Main(string[] args)
    {

        var settings = new ConnectionSettings(new Uri("http://opselastic.elk.apps-ops.boitop.dev.cloud.******.com:9200")).DefaultIndex("apparea_apps");
        var client = new ElasticClient(settings);

        var typeUpdate = new health
        {
            @timestamp = DateTime.Now.ToString("yyyy-MM-ddTHH:mm:ss"),
            apparea = "icross",
            appname = "Test",
            status = "green"
        };

        var IndexResponse = client.Index(typeUpdate)
            ;

    }
}


/// <summary>
/// 
/// </summary>
class health
{
    public string @timestamp { get; set; }
    public string apparea { get; set; }
    public string appname { get; set; }
    public string status { get; set; }
}

}

What I expect:
{
"_index": "apparea_apps",
"_type": "health",
"_id": "AVxgGpY8yhns588mvFP4",
"_score": 1,
"_source": {
"@timestamp": "2017-05-31T15:00:00",
"apparea": "icross",
"appname": "Test",
"status": "green"
}
}

What I get

{
"_index": "apparea_apps",
"_type": "health",
"_id": "AVxgGpY8yhns588mvFP4",
"_score": 1,
"_source": {
"timestamp": "2017-05-31T15:00:00",
"apparea": "icross",
"appname": "Test",
"status": "green"
}
}

Notice the difference in the timestamp? How do I correct this?


(Mike Barretta) #2

I believe the @timestamp field is a special field created by data flowing through date processors on ingest nodes (https://www.elastic.co/guide/en/elasticsearch/reference/5.4/date-processor.html) or logstash (https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html#plugins-filters-date-target).

Is there a reason the field name timestamp won't work?

If you're looking to ingest data into an index that has data coming through a date processor, you might be better off configuring the processor to use timestamp instead by setting the appropriate config option (target for logstash, target_field for ingest node ...why different? who knows), though you'd have to reindex existing data.


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.