How to display a date as a date, not a long, in a terms panel?

Elastic Stack Kibana
1

Hi all,

I have a mapped field called 'start_date' that I want to display in a terms panel as a "human readable" date string, not a long. Is this possible? I did a search through this group and didn't see the question asked, so hopefully it's not a repeat!

Mapping:
"start_date": { "type": "date", "index" : "not_analyzed", "doc_values": true, "norms": { "enabled": false } }

Query:

curl -XGET 'http://myhost:9200/myindex-20150729/_search?pretty' -d '{
  "facets": {
    "terms": {
      "terms": {
        "field": "start_date",
        "size": 10,
        "order": "count",
        "exclude": []
      },
      "facet_filter": {
        "fquery": {
          "query": {
            "filtered": {
              "query": {
                "bool": {
                  "should": [
                    {
                      "query_string": {
                        "query": "(process:Batch) AND (process_result:Fail)"
                      }
                    }
                  ]
                }
              },
              "filter": {
                "bool": {
                  "must": [
                    {
                      "range": {
                        "@timestamp": {
                          "from": 1438186360290,
                          "to": 1438272760290
                        }
                      }
                    },
                    {
                      "fquery": {
                        "query": {
                          "query_string": {
                            "query": "_type:perf_myapp"
                          }
                        },
                        "_cache": true
                      }
                    }
                  ]
                }
              }
            }
          }
        }
      }
    }
  },
  "size": 0
}'

Result:

{
  "took" : 5330,
  "timed_out" : false,
  "_shards" : {
    "total" : 12,
    "successful" : 12,
    "failed" : 0
  },
  "hits" : {
    "total" : 1096575744,
    "max_score" : 0.0,
    "hits" : [ ]
  },
  "facets" : {
    "terms" : {
      "_type" : "terms",
      "missing" : 0,
      "total" : 39376,
      "other" : 16614,
      "terms" : [ {
        "term" : 1438128000000,
        "count" : 4164
      }, {
        "term" : 1438041600000,
        "count" : 3781
      }, {
        "term" : 1438214400000,
        "count" : 3179
      }, {
        "term" : 1437955200000,
        "count" : 2612
      }, {
        "term" : 1438300800000,
        "count" : 2117
      }, {
        "term" : 1439337600000,
        "count" : 1677
      }, {
        "term" : 1437782400000,
        "count" : 1443
      }, {
        "term" : 1437868800000,
        "count" : 1374
      }, {
        "term" : 1438732800000,
        "count" : 1243
      }, {
        "term" : 1437696000000,
        "count" : 1172
      } ]
    }
  }
}

Thank you so much for the advice!
Chris

2

Why are you using facets?

ES stores everything as unix epoch time under the hood and it should convert this back to ISO8601 when it returns the values.

3

Hi Mark,

Well, the short answer is "because that's what Kibana generated." :smile:

I'm trying to help another user who is building a panel that looks like this:

Screen Shot 2015-07-31 at 8.55.23 AM.png928×856 103 KB

to show failure counts by day. Is there a better way to do this that will not use the long representation of the date?

Many thanks as usual.
Chris

4

Just following up on this one. I'm curious if there is another/better way to accomplish this?

Thank you so much!
Chris

5

Hey Chris - I can reproduce this in K3, but not in K4 against the same dataset. From this thread, it looks like in K3 you have to index a readable timestamp as a string as a workaround: http://stackoverflow.com/questions/28466816/kibana-to-display-timestamp-field-into-a-readable-format

However, K4 allows you to specify a date format in Settings and does the sane thing OOB. Have you considered using the new version?

Screen Shot 2015-08-04 at 10.50.36 PM.png1672×102 21.6 KB

Screen Shot 2015-08-04 at 10.43.24 PM.png2478×776 129 KB

6

Thank you Tanya!

I do have K4 in a Dev environment right now, so I'll check there and make sure I can get the format like I need it there, and try and create a string format of the date field and get that working in K3.

Again, thank you so much for your time!
Chris