Swati123
(Swati Sahu)
April 24, 2019, 9:25am
1
I have server logs data of one of the field date as 12/04/2018 11:00:55 -0000 but I am not able to load this data directly even after defining the field mapping as
PUT new-swati-2019.04.24
{
"mappings": {
"doc": {
"properties": {
"request_date": {
"type": "date",
"format": "dd/MMM/yyyy:HH:mm:ss ZZZZ"
}
}
}
}
}
Via filebeat, I guess it's not possible but can we check via logstash configuration ?? or how can we do this?
Please suggest
spinscale
(Alexander Reelsen)
April 25, 2019, 6:28am
2
Hey,
try this
DELETE foo
PUT foo
{
"mappings": {
"properties": {
"date": {
"type": "date",
"format": "dd/MM/yyyy HH:mm:ss Z"
}
}
}
}
PUT foo/_doc/1
{
"date" : "12/04/2018 11:00:55 -0000"
}
GET foo/_search
{
"query": {
"range": {
"date": {
"gte": "2018-04-12",
"format": "strict_date_optional_time"
}
}
}
}
Note, this assumes you are using Elasticsearch 7.0.
--Alex
Swati123
(Swati Sahu)
April 26, 2019, 6:38am
3
@spinscale Thanks Alex for your reply..
But I am using 6.7.0 kibana version.
Could you please help me on this accordingly.
spinscale
(Alexander Reelsen)
April 26, 2019, 6:40am
4
try
DELETE foo
PUT foo
{
"mappings": {
"_doc": {
"properties": {
"date": {
"type": "date",
"format": "dd/MM/yyyy HH:mm:ss Z"
}
}
}
}
}
PUT foo/_doc/1?refresh
{
"date" : "12/04/2018 11:00:55 -0000"
}
GET foo/_search
{
"query": {
"range": {
"date": {
"gte": "2018-04-12",
"format": "strict_date_optional_time"
}
}
}
}
Swati123
(Swati Sahu)
April 26, 2019, 6:46am
5
@spinscale Thanks it worked
system
(system)
Closed
May 24, 2019, 6:46am
6
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.