Single field with multiple date types (date and date_nanos)

Elastic Stack Elasticsearch
1

Is it possible to have a single field have multiple date types (date and date_nanos)? I need date_nanos for the precision but certain tools, such as Kibana streaming logs, only support regular date. So i'd like to index the field two different ways - one as date and the other as date_nanos. Is this possible?

2

Yes, you could use multifields for that. Multifields allow you to index the same value in different ways.

For example, if you define your mapping like this:

PUT my_index
{
  "mappings": {
    "properties": {
      "my_date": {
        "type": "date",
        "fields": {
          "nanos": {
            "type": "date_nanos"
          }
        }
      }
    }
  }
}

Then you can use the my_date field if you need millisecond precision, or my_date.nanos if you need nanosecond precision.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.