Index pattern timeFieldName is getting changed when using CURL command for creation

[manojkrishna561994 (manojkrishna)]

I have a bash script which creates index-pattern using the below curl command and after that http_poller_plugin is run.

" curl -X POST 'localhost:5601/api/saved_objects/index-pattern/lucy_data'  -H 'kbn-xsrf: true'  -H 'Content-Type: application/json' -d'
{
  \"attributes\": {
\"title\": \"lucy_data\",
\"timeFieldName\": \"created_at\"
  }
}'
"

Now, the issue comes, when i run this script, the index-pattern is created using timeFieldName: created_at values and initially everything is working fine when i apply date-time filter and after sometime when i checked the date-time filter again, it was not working as it was before. So i have checked in Management> index-patterns and the timeFieldName value got changed to @timestamp.

How is this happening? I have not changed anything or added data at least.

Is this expected behaviour when using the CURL command to create index-pattern or indices created with "name" instead of uuid?

[wylie (Wylie Conlon)]

The only process that regularly updates index patterns at all is when clicking on fields in Discover, where we update the field popularity. I suspect that the issue here is that you are creating an index pattern without also telling the index pattern about the created_at field, something like this:

{
  "attributes": {
    "title": "lucy_data",
    "timeFieldName": "created_at",
    "fields": '[{"name":"created_at","type":"date","esTypes":["date"],"count":0,"scripted":false,"searchable":true,"aggregatable":true,"readFromDocValues":true}]'
  }
}