I've pushed a lot of data into an index (I admit, poorly named) with a field that looks like this:
"creationdate": "2016-05-24 09:31:09.0600000"
When I search for it as a date I get zero results:
GET /documents/_search
{
"query": {
"range": {
"creationdate": {
"gte": "2016-05-01",
"lte": "2016-05-30"
}
}
}
}
When I search for it as a text field it can be found:
GET /documents/_search
{
"query": {
"multi_match" : {
"query" : "2015-05-24",
"fields" : ["creationdate"]
}
}
}
Is this because I forgot the T in the timestamp?
When I manage the index patterns it correctly identifies it as a date.
When I attempt a visualisation I see this error:
Visualize: Fielddata is disabled on text fields by default. Set fielddata=true on [creationdate] in order to load fielddata in memory by uninverting the inverted index.
What do I need to do to make the date range queries and visualisations work?