Scripted date field returns Invalid date

[elasticheart]

Hi,

I am using ELK GA 5.0.0. I have a field logtime, which contains date and time, and I would like to create a scripted field containing only time (or date), for that I made a Date scripted field showing the time alone. The settings are like below;

Language -> Painless
Type -> Date
Format -> Date
moment.js format pattern -> HH:mm:ss
Popularity -> 0
Script ->
    def dateFormat = new SimpleDateFormat("HH:mm:ss");
    return dateFormat.format(doc['logtime'].value);

What I am trying to accomplish is to get a field with value like 23:59:59, but I am getting an error in Discover, like Invalid date for date field. How can I fix this?

Thanks in advance..

[GautamP (Gautam)]

An alternate solution to creating a scripted field would be to go the Management tab and change the format of the desired field in the respective index.

Here is a screenshot:

Change the Format from -default- to Date.
Change moment.js format pattern to the desired pattern.

[cjcenizal]

You're getting an error because 23:59:59 is actually a string, not a date. So you'll have to change the type to "string".

Thanks,
CJ

[elasticheart]

Hi @cjcenizal agrred. But, if I make it a "string", will I be able to pick it as date histogram (first column in my table visualization) and sort my table based on that?

[cjcenizal]

Oh, good point. I don't think that will work, though it might be worth trying it out and making sure. Have you tried Gautam's solution?

[elasticheart]

Hi @cjcenizal , I don't think that's applicable, because I have some line charts, which needs HH:mm:s.