Using this example:
-
Your index can use the standard date
mapping because it's in the format epoch_millis
. Do not change the date format unless you need to.
-
You can verify that your documents are correctly understood by Elasticsearch by asking it to print the data in another date format, like this:
POST demo-timestamps-2/_search
{
"_source": true,
"fields": [{
"field": "UploadTimestamp",
"format": "date"
}]
}
-
To change the format in Kibana you can either change the Kibana settings which you showed above, or:
-
You can change it for just the field in the index pattern you care about:
Finally, it seems like you have gotten your data into a bad state by messing with this. To test this I reproduced the following scenario:
- Create documents with the wrong date format, as verified by the error on retrieval:
PUT demo-timestamps
PUT demo-timestamps/_mapping
{
"properties": {
"UploadTimestamp": {
"type": "date",
"format": "epoch_second"
}
}
}
PUT demo-timestamps/_doc/1
{
"UploadTimestamp": 1599592944165
}
POST demo-timestamps/_search
{
"_source": true,
"fields": [{
"field": "UploadTimestamp",
"format": "date"
}]
}
- To fix this issue, I reindexed to a correctly-mapped field:
PUT demo-timestamps-2
PUT demo-timestamps-2/_mapping
{
"properties": {
"UploadTimestamp": {
"type": "date"
}
}
}
POST _reindex
{
"source": {
"index": "demo-timestamps"
},
"dest": {
"index": "demo-timestamps-2"
}
}