# Timestamp **URL:** \ **Category:** Elasticsearch\ **Created:** [April 7, 2015, 4:20pm UTC](https://discuss.elastic.co/t/timestamp/23132 "2015-04-07T16:20:33Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![abr](https://avatars.discourse-cdn.com/v4/letter/a/b782af/32.png) [@abr](https://discuss.elastic.co/u/abr)\ **Post date:** [April 7, 2015, 4:20pm UTC](https://discuss.elastic.co/t/timestamp/23132/1 "2015-04-07T16:20:33Z")
Hello, I'm trying to use the timestamp feature to automatically add a timestamp to the newly indexed doc. Since we are already indexing document without timestamp I figured out that I could simply execute: curl -XPUT '[http://localhost:9200/ubilogs-mbr/\_mapping/logs](http://localhost:9200/ubilogs-mbr/_mapping/logs)' -d '{ "logs" : { "\_timestamp" : { "enabled" : true, "stored" : true, "format": "YYYY-MM-dd HH:mm:ss.SSS" } } }' and the next document to be indexed will have the \_timestamp field added. But when I search for the doc with, for example: {"fields":["\_timestamp"],"query":{"match\_all":{}}} I only get { - "\_index": "ubilogs-mbr", - "\_type": "logs", - "\_id": "AUyVGpmfoHcL\_d0dTPU4", - "\_score": 1 } no \_timestamp field here. Is there anything else to do? Is my understanding correct: ES cluster will automatically generate a default \_timestamp with the time when the doc is indexed? Antoine -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/6a82defe-a17e-4b41-977a-584da43a41ad%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/6a82defe-a17e-4b41-977a-584da43a41ad%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [April 7, 2015, 5:24pm UTC](https://discuss.elastic.co/t/timestamp/23132/2 "2015-04-07T17:24:13Z")
Are you doing that using curl or any interface within your browser? If the later, can you try again with curl or Marvel/Sense. If it does not work, gist a full script. BTW what is your version? -- David 😉 Twitter : @dadoonet / @elasticsearchfr / @scrutmydocs > Le 7 avr. 2015 à 18:20, Antoine Brun [abr@ubiqube.com](mailto:abr@ubiqube.com) a écrit : > > Hello, > > I'm trying to use the timestamp feature to automatically add a timestamp to the newly indexed doc. > Since we are already indexing document without timestamp I figured out that I could simply execute: > > curl -XPUT '[http://localhost:9200/ubilogs-mbr/\_mapping/logs](http://localhost:9200/ubilogs-mbr/_mapping/logs)' -d '{ > "logs" : { > "\_timestamp" : { > "enabled" : true, > "stored" : true, > "format": "YYYY-MM-dd HH:mm:ss.SSS" > } > } > }' > > and the next document to be indexed will have the \_timestamp field added. > But when I search for the doc with, for example: > {"fields":["\_timestamp"],"query":{"match\_all":{}}} > > I only get > > { > "\_index": "ubilogs-mbr", > "\_type": "logs", > "\_id": "AUyVGpmfoHcL\_d0dTPU4", > "\_score": 1 > } > > no \_timestamp field here. > Is there anything else to do? > > Is my understanding correct: ES cluster will automatically generate a default \_timestamp with the time when the doc is indexed? > > ## Antoine > > You received this message because you are subscribed to the Google Groups "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/6a82defe-a17e-4b41-977a-584da43a41ad%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/6a82defe-a17e-4b41-977a-584da43a41ad%40googlegroups.com). > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/423AA837-8789-4123-BE16-7A130ED183A1%40pilato.fr](https://groups.google.com/d/msgid/elasticsearch/423AA837-8789-4123-BE16-7A130ED183A1%40pilato.fr). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Antoine\_Brun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/antoine_brun/32/3774_2.png) [@Antoine\_Brun](https://discuss.elastic.co/u/Antoine_Brun)\ **Post date:** [April 7, 2015, 6:41pm UTC](https://discuss.elastic.co/t/timestamp/23132/3 "2015-04-07T18:41:10Z")
Hello, I'm using curl directly from the Linux CLI. The configuration is correctly applied because when I do curl -XGET [http://localhost:9200/ubilogs-mbr/\_mapping](http://localhost:9200/ubilogs-mbr/_mapping) I get this: { "ubilogs-mbr": { "mappings": { "logs": { "dynamic": "strict", _"\_timestamp": { "enabled": true, "format": "yyyy-MM-dd HH:mm:ss" },_ "properties": { "action": { "type": "string", "index": "not\_analyzed", "store": true, "doc\_values": true }, "application": { "type": "string", "index": "not\_analyzed", "store": true, "doc\_values": true }, "attack": { "type": "string", "index": "not\_analyzed", "store": true, "doc\_values": true }, ... } } } } } On Tue, Apr 7, 2015 at 7:24 PM, David Pilato [david@pilato.fr](mailto:david@pilato.fr) wrote: > Are you doing that using curl or any interface within your browser? > > If the later, can you try again with curl or Marvel/Sense. > > If it does not work, gist a full script. > > BTW what is your version? > > -- > David 😉 > Twitter : @dadoonet / @elasticsearchfr / @scrutmydocs > > Le 7 avr. 2015 à 18:20, Antoine Brun [abr@ubiqube.com](mailto:abr@ubiqube.com) a écrit : > > Hello, > > I'm trying to use the timestamp feature to automatically add a timestamp > to the newly indexed doc. > Since we are already indexing document without timestamp I figured out > that I could simply execute: > > curl -XPUT '[http://localhost:9200/ubilogs-mbr/\_mapping/logs](http://localhost:9200/ubilogs-mbr/_mapping/logs)' -d '{ > "logs" : { > "\_timestamp" : { > "enabled" : true, > "stored" : true, > "format": "YYYY-MM-dd HH:mm:ss.SSS" > } > } > }' > > and the next document to be indexed will have the \_timestamp field added. > But when I search for the doc with, for example: > {"fields":["\_timestamp"],"query":{"match\_all":{}}} > > I only get > > { > > - "\_index": "ubilogs-mbr", > - "\_type": "logs", > - "\_id": "AUyVGpmfoHcL\_d0dTPU4", > - "\_score": 1 > > } > > no \_timestamp field here. > Is there anything else to do? > > Is my understanding correct: ES cluster will automatically generate a > default \_timestamp with the time when the doc is indexed? > > Antoine > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/6a82defe-a17e-4b41-977a-584da43a41ad%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/6a82defe-a17e-4b41-977a-584da43a41ad%40googlegroups.com) > [https://groups.google.com/d/msgid/elasticsearch/6a82defe-a17e-4b41-977a-584da43a41ad%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/6a82defe-a17e-4b41-977a-584da43a41ad%40googlegroups.com?utm_medium=email&utm_source=footer) > . > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). > > -- > You received this message because you are subscribed to a topic in the > Google Groups "elasticsearch" group. > To unsubscribe from this topic, visit > [https://groups.google.com/d/topic/elasticsearch/JX95IGNBjt0/unsubscribe](https://groups.google.com/d/topic/elasticsearch/JX95IGNBjt0/unsubscribe). > To unsubscribe from this group and all its topics, send an email to > [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/423AA837-8789-4123-BE16-7A130ED183A1%40pilato.fr](https://groups.google.com/d/msgid/elasticsearch/423AA837-8789-4123-BE16-7A130ED183A1%40pilato.fr) > [https://groups.google.com/d/msgid/elasticsearch/423AA837-8789-4123-BE16-7A130ED183A1%40pilato.fr?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/423AA837-8789-4123-BE16-7A130ED183A1%40pilato.fr?utm_medium=email&utm_source=footer) > . > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- Antoine -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAGUV-q-qzr3S28tBAxjF3nxEzkTgJdOQeF3SsYGPRbeJeP0%3D1A%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAGUV-q-qzr3S28tBAxjF3nxEzkTgJdOQeF3SsYGPRbeJeP0%3D1A%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [April 7, 2015, 6:45pm UTC](https://discuss.elastic.co/t/timestamp/23132/4 "2015-04-07T18:45:23Z")
So \_timestamp is not stored. That’s your concern here. -- David Pilato - Developer | Evangelist > **[Elasticsearch Platform — Find real-time answers at scale](https://www.elastic.co/)** > > Power insights and outcomes with the Elasticsearch Platform and AI. See into your data and find answers that matter with enterprise solutions designed to help you build, observe, and protect. Try Elasticsearch free today. @dadoonet [https://twitter.com/dadoonet](https://twitter.com/dadoonet) | @elasticsearchfr [https://twitter.com/elasticsearchfr](https://twitter.com/elasticsearchfr) | @scrutmydocs [https://twitter.com/scrutmydocs](https://twitter.com/scrutmydocs) > Le 7 avr. 2015 à 20:41, Antoine Brun [antoine.brun@gmail.com](mailto:antoine.brun@gmail.com) a écrit : > > Hello, > > I'm using curl directly from the Linux CLI. > The configuration is correctly applied because when I do > curl -XGET [http://localhost:9200/ubilogs-mbr/\_mapping](http://localhost:9200/ubilogs-mbr/_mapping) [http://localhost:9200/ubilogs-mbr/\_mapping](http://localhost:9200/ubilogs-mbr/_mapping) > > I get this: > > { > "ubilogs-mbr": { > "mappings": { > "logs": { > "dynamic": "strict", > "\_timestamp": { > "enabled": true, > "format": "yyyy-MM-dd HH:mm:ss" > }, > "properties": { > "action": { > "type": "string", > "index": "not\_analyzed", > "store": true, > "doc\_values": true > }, > "application": { > "type": "string", > "index": "not\_analyzed", > "store": true, > "doc\_values": true > }, > "attack": { > "type": "string", > "index": "not\_analyzed", > "store": true, > "doc\_values": true > }, > ... > } > } > } > } > } > > On Tue, Apr 7, 2015 at 7:24 PM, David Pilato \<[david@pilato.fr](mailto:david@pilato.fr) [mailto:david@pilato.fr](mailto:david@pilato.fr)\> wrote: > Are you doing that using curl or any interface within your browser? > > If the later, can you try again with curl or Marvel/Sense. > > If it does not work, gist a full script. > > BTW what is your version? > > -- > David 😉 > Twitter : @dadoonet / @elasticsearchfr / @scrutmydocs > > Le 7 avr. 2015 à 18:20, Antoine Brun \<[abr@ubiqube.com](mailto:abr@ubiqube.com) [mailto:abr@ubiqube.com](mailto:abr@ubiqube.com)\> a écrit : > > > Hello, > > > > I'm trying to use the timestamp feature to automatically add a timestamp to the newly indexed doc. > > Since we are already indexing document without timestamp I figured out that I could simply execute: > > > > curl -XPUT '[http://localhost:9200/ubilogs-mbr/\_mapping/logs](http://localhost:9200/ubilogs-mbr/_mapping/logs)' [http://localhost:9200/ubilogs-mbr/\_mapping/logs'](http://localhost:9200/ubilogs-mbr/_mapping/logs') -d '{ > > "logs" : { > > "\_timestamp" : { > > "enabled" : true, > > "stored" : true, > > "format": "YYYY-MM-dd HH:mm:ss.SSS" > > } > > } > > }' > > > > and the next document to be indexed will have the \_timestamp field added. > > But when I search for the doc with, for example: > > {"fields":["\_timestamp"],"query":{"match\_all":{}}} > > > > I only get > > > > { > > "\_index": "ubilogs-mbr", > > "\_type": "logs", > > "\_id": "AUyVGpmfoHcL\_d0dTPU4", > > "\_score": 1 > > } > > > > no \_timestamp field here. > > Is there anything else to do? > > > > Is my understanding correct: ES cluster will automatically generate a default \_timestamp with the time when the doc is indexed? > > > > Antoine > > > > -- > > You received this message because you are subscribed to the Google Groups "elasticsearch" group. > > To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com) [mailto:elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > > To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/6a82defe-a17e-4b41-977a-584da43a41ad%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/6a82defe-a17e-4b41-977a-584da43a41ad%40googlegroups.com) [https://groups.google.com/d/msgid/elasticsearch/6a82defe-a17e-4b41-977a-584da43a41ad%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/6a82defe-a17e-4b41-977a-584da43a41ad%40googlegroups.com?utm_medium=email&utm_source=footer). > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout) [https://groups.google.com/d/optout](https://groups.google.com/d/optout). > > -- > You received this message because you are subscribed to a topic in the Google Groups "elasticsearch" group. > To unsubscribe from this topic, visit [https://groups.google.com/d/topic/elasticsearch/JX95IGNBjt0/unsubscribe](https://groups.google.com/d/topic/elasticsearch/JX95IGNBjt0/unsubscribe) [https://groups.google.com/d/topic/elasticsearch/JX95IGNBjt0/unsubscribe](https://groups.google.com/d/topic/elasticsearch/JX95IGNBjt0/unsubscribe). > To unsubscribe from this group and all its topics, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com) [mailto:elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/423AA837-8789-4123-BE16-7A130ED183A1%40pilato.fr](https://groups.google.com/d/msgid/elasticsearch/423AA837-8789-4123-BE16-7A130ED183A1%40pilato.fr) [https://groups.google.com/d/msgid/elasticsearch/423AA837-8789-4123-BE16-7A130ED183A1%40pilato.fr?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/423AA837-8789-4123-BE16-7A130ED183A1%40pilato.fr?utm_medium=email&utm_source=footer). > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout) [https://groups.google.com/d/optout](https://groups.google.com/d/optout). > > -- > Antoine > > -- > You received this message because you are subscribed to the Google Groups "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com) [mailto:elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAGUV-q-qzr3S28tBAxjF3nxEzkTgJdOQeF3SsYGPRbeJeP0%3D1A%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAGUV-q-qzr3S28tBAxjF3nxEzkTgJdOQeF3SsYGPRbeJeP0%3D1A%40mail.gmail.com) [https://groups.google.com/d/msgid/elasticsearch/CAGUV-q-qzr3S28tBAxjF3nxEzkTgJdOQeF3SsYGPRbeJeP0%3D1A%40mail.gmail.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/CAGUV-q-qzr3S28tBAxjF3nxEzkTgJdOQeF3SsYGPRbeJeP0%3D1A%40mail.gmail.com?utm_medium=email&utm_source=footer). > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout) [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/EBF879C3-13A4-47A1-845E-CD4DF28D16B2%40pilato.fr](https://groups.google.com/d/msgid/elasticsearch/EBF879C3-13A4-47A1-845E-CD4DF28D16B2%40pilato.fr). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Antoine\_Brun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/antoine_brun/32/3774_2.png) [@Antoine\_Brun](https://discuss.elastic.co/u/Antoine_Brun)\ **Post date:** [April 8, 2015, 8:21am UTC](https://discuss.elastic.co/t/timestamp/23132/5 "2015-04-08T08:21:30Z")
Hello, I solved my problem, thanks. actually the rest command should be: curl -XPUT '[http://localhost:9200/ubilogs-mbr/\_mapping/logs](http://localhost:9200/ubilogs-mbr/_mapping/logs)' -d '{ "logs" : { "\_timestamp" : { "enabled" : true, "store" : true, "format": "YYYY-MM-dd HH:mm:ss.SSS" } } }' with "store" and not "stored", my mistake. Thanks for your answers Antoine On Tue, Apr 7, 2015 at 8:45 PM, David Pilato [david@pilato.fr](mailto:david@pilato.fr) wrote: > So \_timestamp is not stored. > That’s your concern here. > > -- > _David Pilato_ - Developer | Evangelist > _[elastic.co](http://elastic.co) [http://elastic.co](http://elastic.co)_ > @dadoonet [https://twitter.com/dadoonet](https://twitter.com/dadoonet) | @elasticsearchfr > [https://twitter.com/elasticsearchfr](https://twitter.com/elasticsearchfr) | @scrutmydocs > [https://twitter.com/scrutmydocs](https://twitter.com/scrutmydocs) > > Le 7 avr. 2015 à 20:41, Antoine Brun [antoine.brun@gmail.com](mailto:antoine.brun@gmail.com) a écrit : > > Hello, > > I'm using curl directly from the Linux CLI. > The configuration is correctly applied because when I do > curl -XGET [http://localhost:9200/ubilogs-mbr/\_mapping](http://localhost:9200/ubilogs-mbr/_mapping) > > I get this: > > { > "ubilogs-mbr": { > "mappings": { > "logs": { > "dynamic": "strict", > > _"\_timestamp": { "enabled": true, > "format": "yyyy-MM-dd HH:mm:ss" },_ > "properties": { > "action": { > "type": "string", > "index": "not\_analyzed", > "store": true, > "doc\_values": true > }, > "application": { > "type": "string", > "index": "not\_analyzed", > "store": true, > "doc\_values": true > }, > "attack": { > "type": "string", > "index": "not\_analyzed", > "store": true, > "doc\_values": true > }, > ... > } > } > } > } > } > > On Tue, Apr 7, 2015 at 7:24 PM, David Pilato [david@pilato.fr](mailto:david@pilato.fr) wrote: > > > Are you doing that using curl or any interface within your browser? > > > > If the later, can you try again with curl or Marvel/Sense. > > > > If it does not work, gist a full script. > > > > BTW what is your version? > > > > -- > > David 😉 > > Twitter : @dadoonet / @elasticsearchfr / @scrutmydocs > > > > Le 7 avr. 2015 à 18:20, Antoine Brun [abr@ubiqube.com](mailto:abr@ubiqube.com) a écrit : > > > > Hello, > > > > I'm trying to use the timestamp feature to automatically add a timestamp > > to the newly indexed doc. > > Since we are already indexing document without timestamp I figured out > > that I could simply execute: > > > > curl -XPUT '[http://localhost:9200/ubilogs-mbr/\_mapping/logs](http://localhost:9200/ubilogs-mbr/_mapping/logs)' -d '{ > > "logs" : { > > "\_timestamp" : { > > "enabled" : true, > > "stored" : true, > > "format": "YYYY-MM-dd HH:mm:ss.SSS" > > } > > } > > }' > > > > and the next document to be indexed will have the \_timestamp field added. > > But when I search for the doc with, for example: > > {"fields":["\_timestamp"],"query":{"match\_all":{}}} > > > > I only get > > > > { > > > > - "\_index": "ubilogs-mbr", > > - "\_type": "logs", > > - "\_id": "AUyVGpmfoHcL\_d0dTPU4", > > - "\_score": 1 > > > > } > > > > no \_timestamp field here. > > Is there anything else to do? > > > > Is my understanding correct: ES cluster will automatically generate a > > default \_timestamp with the time when the doc is indexed? > > > > Antoine > > > > -- > > You received this message because you are subscribed to the Google Groups > > "elasticsearch" group. > > To unsubscribe from this group and stop receiving emails from it, send an > > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > > To view this discussion on the web visit > > [https://groups.google.com/d/msgid/elasticsearch/6a82defe-a17e-4b41-977a-584da43a41ad%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/6a82defe-a17e-4b41-977a-584da43a41ad%40googlegroups.com) > > [https://groups.google.com/d/msgid/elasticsearch/6a82defe-a17e-4b41-977a-584da43a41ad%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/6a82defe-a17e-4b41-977a-584da43a41ad%40googlegroups.com?utm_medium=email&utm_source=footer) > > . > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). > > > > -- > > You received this message because you are subscribed to a topic in the > > Google Groups "elasticsearch" group. > > To unsubscribe from this topic, visit > > [https://groups.google.com/d/topic/elasticsearch/JX95IGNBjt0/unsubscribe](https://groups.google.com/d/topic/elasticsearch/JX95IGNBjt0/unsubscribe). > > To unsubscribe from this group and all its topics, send an email to > > [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > > To view this discussion on the web visit > > [https://groups.google.com/d/msgid/elasticsearch/423AA837-8789-4123-BE16-7A130ED183A1%40pilato.fr](https://groups.google.com/d/msgid/elasticsearch/423AA837-8789-4123-BE16-7A130ED183A1%40pilato.fr) > > [https://groups.google.com/d/msgid/elasticsearch/423AA837-8789-4123-BE16-7A130ED183A1%40pilato.fr?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/423AA837-8789-4123-BE16-7A130ED183A1%40pilato.fr?utm_medium=email&utm_source=footer) > > . > > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). > > -- > Antoine > > -- > You received this message because you are subscribed to the Google Groups > "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/CAGUV-q-qzr3S28tBAxjF3nxEzkTgJdOQeF3SsYGPRbeJeP0%3D1A%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAGUV-q-qzr3S28tBAxjF3nxEzkTgJdOQeF3SsYGPRbeJeP0%3D1A%40mail.gmail.com) > [https://groups.google.com/d/msgid/elasticsearch/CAGUV-q-qzr3S28tBAxjF3nxEzkTgJdOQeF3SsYGPRbeJeP0%3D1A%40mail.gmail.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/CAGUV-q-qzr3S28tBAxjF3nxEzkTgJdOQeF3SsYGPRbeJeP0%3D1A%40mail.gmail.com?utm_medium=email&utm_source=footer) > . > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). > > -- > You received this message because you are subscribed to a topic in the > Google Groups "elasticsearch" group. > To unsubscribe from this topic, visit > [https://groups.google.com/d/topic/elasticsearch/JX95IGNBjt0/unsubscribe](https://groups.google.com/d/topic/elasticsearch/JX95IGNBjt0/unsubscribe). > To unsubscribe from this group and all its topics, send an email to > [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit > [https://groups.google.com/d/msgid/elasticsearch/EBF879C3-13A4-47A1-845E-CD4DF28D16B2%40pilato.fr](https://groups.google.com/d/msgid/elasticsearch/EBF879C3-13A4-47A1-845E-CD4DF28D16B2%40pilato.fr) > [https://groups.google.com/d/msgid/elasticsearch/EBF879C3-13A4-47A1-845E-CD4DF28D16B2%40pilato.fr?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/EBF879C3-13A4-47A1-845E-CD4DF28D16B2%40pilato.fr?utm_medium=email&utm_source=footer) > . > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- Antoine -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAGUV-q8ZiQ4rEGCCosUk5M0QT-WFhGiUZFZ1bHRa4wqXTFtM3w%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAGUV-q8ZiQ4rEGCCosUk5M0QT-WFhGiUZFZ1bHRa4wqXTFtM3w%40mail.gmail.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![abr](https://avatars.discourse-cdn.com/v4/letter/a/b782af/32.png) [@abr](https://discuss.elastic.co/u/abr)\ **Post date:** [April 16, 2015, 3:33pm UTC](https://discuss.elastic.co/t/timestamp/23132/6 "2015-04-16T15:33:09Z")
Hello, based on the comments I could create a new index with \_timestamp activated and it works great. Now my probleme arrives when I want to activate the timestamp on an existing index. Since \_timestamp is not stored by default, I wanted to set "store" to true, but I get { "error": "MergeMappingException[Merge failed with failures {[mapper [\_timestamp] has different store values]}]", "status": 400 } Is there any way to achieve this? Antoine Le mardi 7 avril 2015 18:20:33 UTC+2, Antoine Brun a écrit : > Hello, > > I'm trying to use the timestamp feature to automatically add a timestamp > to the newly indexed doc. > Since we are already indexing document without timestamp I figured out > that I could simply execute: > > curl -XPUT '[http://localhost:9200/ubilogs-mbr/\_mapping/logs](http://localhost:9200/ubilogs-mbr/_mapping/logs)' -d '{ > "logs" : { > "\_timestamp" : { > "enabled" : true, > "stored" : true, > "format": "YYYY-MM-dd HH:mm:ss.SSS" > } > } > }' > > and the next document to be indexed will have the \_timestamp field added. > But when I search for the doc with, for example: > {"fields":["\_timestamp"],"query":{"match\_all":{}}} > > I only get > > { > > - "\_index": "ubilogs-mbr", > - "\_type": "logs", > - "\_id": "AUyVGpmfoHcL\_d0dTPU4", > - "\_score": 1 > > } > > no \_timestamp field here. > Is there anything else to do? > > Is my understanding correct: ES cluster will automatically generate a > default \_timestamp with the time when the doc is indexed? > > Antoine -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/c2cad5d1-038c-4a76-a9e8-1dca1ea81d59%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/c2cad5d1-038c-4a76-a9e8-1dca1ea81d59%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [April 16, 2015, 5:10pm UTC](https://discuss.elastic.co/t/timestamp/23132/7 "2015-04-16T17:10:35Z")
You need to reindex in a new index. -- David 😉 Twitter : @dadoonet / @elasticsearchfr / @scrutmydocs > Le 16 avr. 2015 à 17:33, Antoine Brun [abr@ubiqube.com](mailto:abr@ubiqube.com) a écrit : > > Hello, > > based on the comments I could create a new index with \_timestamp activated and it works great. > Now my probleme arrives when I want to activate the timestamp on an existing index. > Since \_timestamp is not stored by default, I wanted to set "store" to true, but I get > > { > "error": "MergeMappingException[Merge failed with failures {[mapper [\_timestamp] has different store values]}]", > "status": 400 > } > > Is there any way to achieve this? > > Antoine > > Le mardi 7 avril 2015 18:20:33 UTC+2, Antoine Brun a écrit : > > > Hello, > > > > I'm trying to use the timestamp feature to automatically add a timestamp to the newly indexed doc. > > Since we are already indexing document without timestamp I figured out that I could simply execute: > > > > curl -XPUT '[http://localhost:9200/ubilogs-mbr/\_mapping/logs](http://localhost:9200/ubilogs-mbr/_mapping/logs)' -d '{ > > "logs" : { > > "\_timestamp" : { > > "enabled" : true, > > "stored" : true, > > "format": "YYYY-MM-dd HH:mm:ss.SSS" > > } > > } > > }' > > > > and the next document to be indexed will have the \_timestamp field added. > > But when I search for the doc with, for example: > > {"fields":["\_timestamp"],"query":{"match\_all":{}}} > > > > I only get > > > > { > > "\_index": "ubilogs-mbr", > > "\_type": "logs", > > "\_id": "AUyVGpmfoHcL\_d0dTPU4", > > "\_score": 1 > > } > > > > no \_timestamp field here. > > Is there anything else to do? > > > > Is my understanding correct: ES cluster will automatically generate a default \_timestamp with the time when the doc is indexed? > > > > Antoine > > -- > You received this message because you are subscribed to the Google Groups "elasticsearch" group. > To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). > To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/c2cad5d1-038c-4a76-a9e8-1dca1ea81d59%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/c2cad5d1-038c-4a76-a9e8-1dca1ea81d59%40googlegroups.com). > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/E558667C-C0B1-4AAD-85D0-956D51F9D2B8%40pilato.fr](https://groups.google.com/d/msgid/elasticsearch/E558667C-C0B1-4AAD-85D0-956D51F9D2B8%40pilato.fr). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 12:19am UTC](https://discuss.elastic.co/t/timestamp/23132/8 "2017-07-06T00:19:15Z")