How to add date mapping in existing template

Elastic Stack Elasticsearch
1

i have a default filebeat template, How to add date filed in that existing template.?
For example;
in log i have Time field as string i need to convert into timestamp field,
I tried with logstash , the Time filed is changed from
Time : 2017-08-21_03:44:31.190 to
timestamp: 2017-08-21T03:44:31.190Z
i got the timestamp converted properly But timestamp is still showing as string field in kibana.
my sample conf:
date { match => ["Time","yyyy-MM-dd_HH:mm:ss.SSS"] timezone => "UTC" target => "timestamp" }

1- How do i map timestamp as date field

2

I'm using this for my date in LS and is working properly.

date {
	locale => "en"
	match => ["returnDate", "dd.MM.YYYY"]
	timezone => "Europe/Ljubljana"
	target => "returnDate"
}

Maybe it isn't working because you left out locale property.

After your example you'll have a field timestamp and a field Time. I'm assuming you don't need Time any more so just unset/remove it.

1 Like
3

thaks for your reply. yeah i tried but both timestamp and Time is showing as string in kibana..

4

I've checked the documentation. So locale is not required. So this is not the case.

When I was configuring my dates in LS, I needed to remove my index and create it again. After that my fields were ok.
I'm not sure if this is the case. Would recommend, that you post your date in a new (never used) field. If this is ok, then reindex or remove/index your index.

1 Like
5

i posted my date in a new and never used field called date, Time is converted to date but still Showing as string
date :2017-08-21T03:44:31.953Z

6

Did you just checked this in results or did you also checked your mapping?
If you didn't, you can check you fields under Kibana/Management or you just select your mapping with

GET /YOUR INDEX/_mapping/
1 Like
7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.