# Template mapping success, filtering with it failed
**URL:** https://discuss.elastic.co/t/template-mapping-success-filtering-with-it-failed/18691
**Category:** Elasticsearch
**Created:** [July 16, 2014, 7:28am UTC](https://discuss.elastic.co/t/template-mapping-success-filtering-with-it-failed/18691 "2014-07-16T07:28:45Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@t\_goto](https://discuss.elastic.co/u/t_goto)
#### Post date: [July 16, 2014, 7:28am UTC](https://discuss.elastic.co/t/template-mapping-success-filtering-with-it-failed/18691/1 "2014-07-16T07:28:45Z")
Hi,
I've successfuly create a template to map a specific timestamp from log
like below.
{
"tempalte\_blahblah" : {
"template" : "logstash\*",
"mappings" : {
"blah" : {
"properties" : {
"hostname": { "type": "string", "index":"not\_analyzed" },
"time\_raw": { "type": "date", "index": "analyzed", "format": "yyyy-MM-dd
HH:mm:ss.SSS" }
}
}
}
}
And log looks like this..
2014-07-14 13:02:32.128 25121 (host) (COMMAND) (message)
2014-07-14 13:02:32.133 25121 (host) (COMMAND) (message)
Now, I can see "time\_raw" from Kibana or API query 🙂
But when I use "time\_raw" as timefield for Timepicker in Kibana, nothing
hits.
I tried query with range for the "time\_raw" in epoch, nothing hits too.
curl -XGET '[http://localhost:9200/logstash-2014.07.16/\_search?pretty](http://localhost:9200/logstash-2014.07.16/_search?pretty)' -d '{
"query":{
"bool":{
"must":[
{
"range":{
"time\_raw": {
"from": 1405490989000,
"to": 1405491289000
}
}
}
]
}
}
}'
Somehow I tried query with range for the "time\_raw" in date+milliseconds,
now it hits.
curl -XGET '[http://localhost:9200/logstash-2014.07.16/\_search?pretty](http://localhost:9200/logstash-2014.07.16/_search?pretty)' -d '{
"query":{
"bool":{
"must":[
{
"range":{
"time\_raw": {
"from": "2014-7-16 15:09:49.000",
"to": "2014-7-16 15:14:49.000"
}
}
}
]
}
}
}'
Since I'm heavily relying on Kibana, I need to use epoch time. (Kibana uses
epoch time right?)
Did I misconfigure something here?
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/79731080-b8bd-4f29-9bd0-e30165336967%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/79731080-b8bd-4f29-9bd0-e30165336967%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@t\_goto](https://discuss.elastic.co/u/t_goto)
#### Post date: [July 16, 2014, 8:38am UTC](https://discuss.elastic.co/t/template-mapping-success-filtering-with-it-failed/18691/2 "2014-07-16T08:38:12Z")
Hi,
I don't understand why, but when I changed "time\_raw"'s index as
"not\_analyzed", it worked.
{
"tempalte\_blahblah" : {
"template" : "logstash\*",
"mappings" : {
"blah" : {
"properties" : {
"hostname": { "type": "string", "index":"not\_analyzed" },
"time\_raw": { "type": "date", "index": "not\_analyzed", "format": "yyyy-MM-dd
HH:mm:ss.SSS" }
}
}
}
}
I really need to study hard behavior of elasticsearch, thanks.
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/1e05e3aa-0756-44f6-bb92-f874ef8fe3b4%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/1e05e3aa-0756-44f6-bb92-f874ef8fe3b4%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:15am UTC](https://discuss.elastic.co/t/template-mapping-success-filtering-with-it-failed/18691/3 "2017-07-06T01:15:32Z")