Insert {now-1m/d} failure

Elastic Stack Elasticsearch
1

Hello is it possible to insert a document using the current time, like this?

PUT /tmp
{
  "mappings": {
    "properties": {
      "@timestamp": {
        "type": "date" 
      }
    }
  }
}

POST tmp/_doc/1
{
  "@timestamp":"{now-1m/d}"
}

So far i am unsuccessful, but unsure it this is not possible, or i am doing something wrong.

{
  "error": {
    "root_cause": [
      {
        "type": "mapper_parsing_exception",
        "reason": "failed to parse field [@timestamp] of type [date] in document with id '1'. Preview of field's value: '{now-1m/d}'"
      }
    ],
    "type": "mapper_parsing_exception",
    "reason": "failed to parse field [@timestamp] of type [date] in document with id '1'. Preview of field's value: '{now-1m/d}'",
    "caused_by": {
      "type": "illegal_argument_exception",
      "reason": "failed to parse date field [{now-1m/d}] with format [strict_date_optional_time||epoch_millis]",
      "caused_by": {
        "type": "date_time_parse_exception",
        "reason": "Failed to parse with all enclosed parsers"
      }
    }
  },
  "status": 400

It is hard to tell if what i am trying IS possible, but i need to set the date format, or what i am trying is NOT possible.

2

Unfortunately, you cannot use the now syntax at index time. It is a query-time construct.

What you could do instead is define an ingest pipeline that automatically adds a timestamp to your documents. This post explains how to do that. Instead of the set processor used in that post, you'd use a script processor to format the date exactly how you want it.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.