I am parsing my logs date using this filter:
match => [ "datetime", "YYYY-MM-dd HH:mm:ss.SSS" ]
target => "datetime"
but the new "datetime" field is created of type string. How can it be created of type date?
I cant use the default @timestamp because NEST library doesnt retrieve it ok
It should get mapped as a date, at least in the format produced by the date filter. Perhaps it was mapped as a string before you had the date filter in place? The first document you sent maybe had a timestamp in a format that wasn't recognized as a date and therefore the field was mapped as a string.
yes i deleted index and next time it was created it was mapped right as time. thanks!