Failed to make a string raw for date

(xlbrlx) #1

I want to search a date field without using range. So I decided to make a string raw to search into it as it is text:

 "myDate": {
                            "type": "date",
                            "format": " yyyy-MM-dd || yyyy-MM || Y ||date_hour_minute_second",
                            "fields": {
                                "raw": {
                                    "type": "string",
                                    "index": "not_analyzed",
                                    "null_value": "",
                                    "doc_values": true

But it shows up in kibana nothing for myDate.raw. Any idea?


(Lee Drengenberg) #2

When you say that nothing shows up in Kibana for myDate.raw are you looking at the Discover tab?

If so, I think that's normal. In an index of mine I have both extension and extension.raw. You can see them in the Management > Index Patterns screen when I select that index pattern and filter on extension;

And then in Discover, I don't see extension.raw by default, but if I click the settings gear, and then uncheck Hide Missing Fields, I see it. But when I add it to the doc view it doesn't show any values.

But in Visualize, it's the other way around. I can't do an aggregation on extension but I can on extension.raw (see the first screenshot where it shows which of them is aggregatable).

(xlbrlx) #3


Thanks for your reply. You are right about this. I do some other investigation and realized when they both are string it works and I can search thru the .raw. But when one is date and the other is string, there is no result.

(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.