Is my date field being parsed as a text field?

I've pushed a lot of data into an index (I admit, poorly named) with a field that looks like this:
"creationdate": "2016-05-24 09:31:09.0600000"

When I search for it as a date I get zero results:
GET /documents/_search
{
"query": {
"range": {
"creationdate": {
"gte": "2016-05-01",
"lte": "2016-05-30"
}
}
}
}

When I search for it as a text field it can be found:
GET /documents/_search
{
"query": {
"multi_match" : {
"query" : "2015-05-24",
"fields" : ["creationdate"]
}
}
}

Is this because I forgot the T in the timestamp?

When I manage the index patterns it correctly identifies it as a date.
When I attempt a visualisation I see this error:
Visualize: Fielddata is disabled on text fields by default. Set fielddata=true on [creationdate] in order to load fielddata in memory by uninverting the inverted index.

What do I need to do to make the date range queries and visualisations work?

Create the right mapping for this field.
See https://www.elastic.co/guide/en/elasticsearch/reference/current/date.html

I formatted the field in accordance with the first bullet point on the linked page (using a space character to separate the date and the time). Elastic automagically determines that it's a date, but the range based queries don't work.

In playing with my environment I've discovered that you must separate the date and the time with the letter T. The queries now work as expected.

What this doesn't tell me is whether the dot milliseconds is valid syntax, or whether I must use the letter Z.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.