I've recently tried to use kibana lens and realised that my time filter in control is filtering by date time. Is there a way to make it filter by date instead?
what I plan to obtain is something similar to this:
One option to do this would be to ingest the current date without time in a separate keyword field, then build the filter based on that. I guess it would be possible to work with date ranges as well, but it won't be as comfortable because AFAIK the UI won't help you with this
From what I know from my research is that I am able to change my date formate by creating a new index pattern data field. However, I am rather confuse on how to move forward. I've read about painless scripting language specifically about datetime formatting too
Using Datetime in Painless | Painless Scripting Language [master] | Elastic
Image below is for creating a new index pattern data field called newDate.
Any advice would be appreciated!
Hi @Arrick Welcome to the community.
Did you look at setting a custom time interval in Lens Data Table.
Hello @stephenb , yep I did look at the settings and it does work
However, my issue is more in the control section and not in the lens section. Where I am unable to change my datetime filter into just date (eg, YYYY/MM/DD).
This runtime field -
ZonedDateTime input = doc['@timestamp'].value;
String output = input.format(DateTimeFormatter.ISO_LOCAL_DATE);
emit(output);
Will return date in yyyy-mm-dd
This page is very useful for date formatters -
https://docs.oracle.com/javase/8/docs/api/java/time/format/DateTimeFormatter.html
1 Like
Hello @ghudgins , thank you for your help! The documentation is really helpful in understanding. I tried to emit my output but kibana just keeps giving me syntax error when emitting. I noticed that I cant emit anything.
I tried changing my type from Date to Long but I still gets the same error when emitting.
The Field Type should be keyword since your are emitting a string that you want to aggregate / filter on.
The code above should work.
.
2 Likes
Thank you @stephenb !! It works perfectly now, thank you so much for your guidance
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.