# Kibana 4.1.1 unable to map timestamp which is in UNIX Epoch format

**URL:** https://discuss.elastic.co/t/kibana-4-1-1-unable-to-map-timestamp-which-is-in-unix-epoch-format/28244
**Category:** Kibana
**Created:** [August 28, 2015, 1:30pm UTC](https://discuss.elastic.co/t/kibana-4-1-1-unable-to-map-timestamp-which-is-in-unix-epoch-format/28244 "2015-08-28T13:30:19Z")
**Posts on this page:** 10
**Page:** 1

<div class="post-metadata">

### Author: ![cloud\_admin](https://avatars.discourse-cdn.com/v4/letter/c/3ec8ea/32.png) [@cloud\_admin](https://discuss.elastic.co/u/cloud_admin)
#### Post date: [August 28, 2015, 1:30pm UTC](https://discuss.elastic.co/t/kibana-4-1-1-unable-to-map-timestamp-which-is-in-unix-epoch-format/28244/1 "2015-08-28T13:30:19Z")

</div>

Hi Team,

I have recently upgraded my Kibana from 3 to 4.1.1, my nginx access logs has Epoch Time format like 1434589605.318 and kibana is not able to detect this time stamp field, hence I am not able to segregate the logs, however if I try the same access logs on kibana3 it is able to detect timestamp after I mention the filed in Time picker.

Please guide me on how to map this time stamp to index so that I can segregate the logs based on time stamp.

Thanks and Regards,  
Naren.

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [August 29, 2015, 10:36pm UTC](https://discuss.elastic.co/t/kibana-4-1-1-unable-to-map-timestamp-which-is-in-unix-epoch-format/28244/2 "2015-08-29T22:36:20Z")

</div>

What does the mapping in ES look like for that field?

---

<div class="post-metadata">

### Author: ![tbragin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tbragin/32/45166_2.png) [@tbragin](https://discuss.elastic.co/u/tbragin)
#### Post date: [September 2, 2015, 3:53am UTC](https://discuss.elastic.co/t/kibana-4-1-1-unable-to-map-timestamp-which-is-in-unix-epoch-format/28244/3 "2015-09-02T03:53:45Z")

</div>

There is no change in the way Kibana 4 treats timestamps, compared to Kibana 3. Both require that your time field is mapped as a "date" in Elasticsearch.

For reference, here is a sample mapping that works:

```
  "@timestamp" : {
    "type" : "date",
    "format" : "strict_date_optional_time||epoch_millis"
  },
```

---

<div class="post-metadata">

### Author: ![cloud\_admin](https://avatars.discourse-cdn.com/v4/letter/c/3ec8ea/32.png) [@cloud\_admin](https://discuss.elastic.co/u/cloud_admin)
#### Post date: [September 3, 2015, 7:30pm UTC](https://discuss.elastic.co/t/kibana-4-1-1-unable-to-map-timestamp-which-is-in-unix-epoch-format/28244/4 "2015-09-03T19:30:15Z")

</div>

> [@tbragin](#):
>
> "@timestamp" : {  
> "type" : "date",  
> "format" : "strict\_date\_optional\_time||epoch\_millis"  
> },

Thanks for your reply, my kibana4 gets logs from one ES cluster where time format is in epoch format and it is mapped to field "ts", however nothing is being displayed in indices filed

 ![](https://us1.discourse-cdn.com/elastic/original/2X/2/2744143e87299c2070047b1a9a54ab24dd44c0ad.png) could you please guide me on where should I map the ts field so that it will populate in Indices

Thanks and Regards,  
Narendra.

---

<div class="post-metadata">

### Author: ![tbragin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tbragin/32/45166_2.png) [@tbragin](https://discuss.elastic.co/u/tbragin)
#### Post date: [September 10, 2015, 10:32pm UTC](https://discuss.elastic.co/t/kibana-4-1-1-unable-to-map-timestamp-which-is-in-unix-epoch-format/28244/5 "2015-09-10T22:32:33Z")

</div>

Could you post your mappings from ES to make sure we're talking about the same thing?

---

<div class="post-metadata">

### Author: ![cloud\_admin](https://avatars.discourse-cdn.com/v4/letter/c/3ec8ea/32.png) [@cloud\_admin](https://discuss.elastic.co/u/cloud_admin)
#### Post date: [September 11, 2015, 12:23pm UTC](https://discuss.elastic.co/t/kibana-4-1-1-unable-to-map-timestamp-which-is-in-unix-epoch-format/28244/6 "2015-09-11T12:23:23Z")

</div>

Hi Tanya,

Thanks for your reply, below are my mappings.

 ![](https://us1.discourse-cdn.com/elastic/original/2X/e/e66408ec8d8456b057fca3bef355a9dd26141642.png) ![](https://us1.discourse-cdn.com/elastic/original/2X/0/07bbb0e390f38fc879590c4eaf82bb921a91e1b6.png)

---

<div class="post-metadata">

### Author: ![tbragin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tbragin/32/45166_2.png) [@tbragin](https://discuss.elastic.co/u/tbragin)
#### Post date: [September 11, 2015, 1:45pm UTC](https://discuss.elastic.co/t/kibana-4-1-1-unable-to-map-timestamp-which-is-in-unix-epoch-format/28244/7 "2015-09-11T13:45:08Z")

</div>

So, I don't see anything with type "date" in there -- that's what you need.

 ![](https://us1.discourse-cdn.com/elastic/original/2X/c/c3101baf7a6764f60e491b600e9d8f64be831b68.png)

---

<div class="post-metadata">

### Author: ![cloud\_admin](https://avatars.discourse-cdn.com/v4/letter/c/3ec8ea/32.png) [@cloud\_admin](https://discuss.elastic.co/u/cloud_admin)
#### Post date: [September 12, 2015, 3:52pm UTC](https://discuss.elastic.co/t/kibana-4-1-1-unable-to-map-timestamp-which-is-in-unix-epoch-format/28244/8 "2015-09-12T15:52:06Z")

</div>

The Field TS is the timestamp in epoch format, in kiabna 3 I am able to mention @ts in time picker and it is able to recognise it, however in kibana4 i am not able to map it,

 ![](https://us1.discourse-cdn.com/elastic/original/2X/3/3a90d94a4c8dd526545cfde8ce46dc8c80ee6ddd.png)

Is there a way to mention it in kibana4 apart from modifying it in elastic search?

---

<div class="post-metadata">

### Author: ![derandreasberger](https://avatars.discourse-cdn.com/v4/letter/d/cc9497/32.png) [@derandreasberger](https://discuss.elastic.co/u/derandreasberger)
#### Post date: [December 16, 2015, 3:57pm UTC](https://discuss.elastic.co/t/kibana-4-1-1-unable-to-map-timestamp-which-is-in-unix-epoch-format/28244/9 "2015-12-16T15:57:54Z")

</div>

Hello!  
I've been struggling with timestamps too. The only way i found to get it to work as i wanted to, was to create a new template for timestamp mapping.  
curl -XPUT '[http://YOURELASTICSEARCHSERVER:9200/\_template/indexname\*/](http://YOURELASTICSEARCHSERVER:9200/_template/indexname*/)' -d @elastic\_template.json

content of file "elastic\_template.json"  
{  
"template": "indexname\*",  
"order": 1,  
"mappings" : {  
"index" : {  
"properties" : {  
"log\_date" : {  
"type" : "date",  
"format": "yyyy-MM-dd HH:mm:ss,SSS||yyyy-MM-dd HH:mm:ss.SSS||yyyy/MM/dd HH:mm:ss||yyyy-MM-dd||MMM dd, yyyy HH:mm:ss a"  
},  
"appname" : {  
"type" : "string",  
"index": "not\_analyzed"  
},  
"msg\_content" : {  
"type" : "string"  
}  
}  
}  
}  
}  
}

I guess this will work for epoch\_millis as well. Most important thing: Ensure elasticsearch is saving your timestamp as date, check with:  
curl -XGET '[http://YOURELASTICSEARCHSERVER:9200/indexname\*/\_mapping?pretty](http://YOURELASTICSEARCHSERVER:9200/indexname*/_mapping?pretty)'

Hope it helps!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 2:06pm UTC](https://discuss.elastic.co/t/kibana-4-1-1-unable-to-map-timestamp-which-is-in-unix-epoch-format/28244/10 "2017-07-06T14:06:29Z")

</div>


