I have ugraded to kibana4 and by default kibana was able to find and add two of my indices (logstash-[date], and another), however, I am having an issue adding the rest of the indices. I can go to Settings -> Indices -> "Add New Index +", but after I type the name of the index kibana cannot seem to resolve a timestamp value. The drop-down for the "Time-Field Name" has no selectable values. Any ideas on what I may need to do to populate that field?
Are you sure those indices have timestamp mapped fields?
Hey Mark,
The events in the indices do have timestamp attributes but they are just unix timestamps stored as string e.g.
{
...
, "time": "1438116761767"
, ...
}.
Kibana does not show "time" as an option for the timestamp filed. In other events we use a timestamp like "2005-06-26" and kibana does show this attribute as an option. Is there something specific I need to be doing with my timestamp values to indicate to kibana that these can be treated as time?
cheers
Well if it's not stored as a timestamp formatted field then KB won't know it's a timestamp.
You need to fix that in your mapping.
Ah, yea. That makes sense. thanks!