# How to make timeline from Hadoop data?

**URL:** <https://discuss.elastic.co/t/how-to-make-timeline-from-hadoop-data/116390>\
**Category:** Elasticsearch\
**Tags:** es-hadoop\
**Created:** [January 21, 2018, 2:11pm UTC](https://discuss.elastic.co/t/how-to-make-timeline-from-hadoop-data/116390 "2018-01-21T14:11:34Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![BicaLuv](https://avatars.discourse-cdn.com/v4/letter/b/c5a1d2/32.png) [@BicaLuv](https://discuss.elastic.co/u/BicaLuv)\
**Post date:** [January 21, 2018, 2:11pm UTC](https://discuss.elastic.co/t/how-to-make-timeline-from-hadoop-data/116390/1 "2018-01-21T14:11:34Z")

</div>

Hello!  
I'm currently using Elasticsearch Hadoop from my Spark Structured Streaming job which generates data having the following schema:  
root  
|-- id: string (nullable = true)  
|-- eventTime: timestamp (nullable = true)

I get all my data into Elasticsearch and can discover it. But When I try to use Machine Learning with my index, I always get the error "Index pattern spark-index\* is not time based". But I do have a time field.  
My index is created with this command:  
PUT spark-index?pretty  
{  
"settings" : {  
"number\_of\_shards" : 1  
},  
"mappings" : {  
"exc" : {  
"properties" : {  
"id" : { "type" : "text" },  
"eventTime":{ "type" : "date"  
}  
}  
}  
}  
}  
What I am doing wrong here?  
Hope my first question is not too stupid!

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 21, 2018, 7:06pm UTC](https://discuss.elastic.co/t/how-to-make-timeline-from-hadoop-data/116390/2 "2018-01-21T19:06:54Z")

</div>

When you added the index pattern, did you make sure you defined it as time based by picking a time field?

---

<div class="post-metadata">

**Author:** ![BicaLuv](https://avatars.discourse-cdn.com/v4/letter/b/c5a1d2/32.png) [@BicaLuv](https://discuss.elastic.co/u/BicaLuv)\
**Post date:** [January 21, 2018, 7:23pm UTC](https://discuss.elastic.co/t/how-to-make-timeline-from-hadoop-data/116390/3 "2018-01-21T19:23:45Z")

</div>

What exactly do you mean by defining it time based? How do I check this?  
I defined the mapping of field eventTime as type date.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 22, 2018, 4:42am UTC](https://discuss.elastic.co/t/how-to-make-timeline-from-hadoop-data/116390/4 "2018-01-22T04:42:50Z")

</div>

As per [https://www.elastic.co/guide/en/kibana/current/tutorial-define-index.html](https://www.elastic.co/guide/en/kibana/current/tutorial-define-index.html)

---

<div class="post-metadata">

**Author:** ![BicaLuv](https://avatars.discourse-cdn.com/v4/letter/b/c5a1d2/32.png) [@BicaLuv](https://discuss.elastic.co/u/BicaLuv)\
**Post date:** [January 22, 2018, 5:46am UTC](https://discuss.elastic.co/t/how-to-make-timeline-from-hadoop-data/116390/5 "2018-01-22T05:46:34Z")

</div>

After carefully reading the linked article, especially the "Note" paragraph I got it to work.  
The trick was to first generate an index with my field named "eventTime" having the type "date". Then importing the some data and after that generating an index pattern.  
Thanks for the hint!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 19, 2018, 5:47am UTC](https://discuss.elastic.co/t/how-to-make-timeline-from-hadoop-data/116390/6 "2018-02-19T05:47:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.