Timestamps stored as seconds since Unix epoch

Elastic Stack Elasticsearch
1

Hi all,

Not sure what I'm doing wrong, but I couldn't find a way to store my docs
with timestamps as seconds since the Unix epoch and query them properly. I
have my date/time field mapped like this:

"start_time": {"type": "date" },

I store documents like this:

{ "start_time": 1427631731, ... }

And get no result when I do a range query like this:

"query": {
     "range": { "@timestamp": { "gte": "2015-03-29" }}
}

I have good results when I store timestamps as strings in ISO format.

Is that supposed to work? Is there a specific date parser I should use?

JM

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CALZqptaAcQ%3DtC2s1HPNeh%2BrpD5UdT_rRvvFcjNFPXQ%2Bt3SbEqA%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

2

Of course I left a typo in my email: I do use the same field name across
mapping def, docs and queries, and it does not work.

JM

On Sun, Mar 29, 2015 at 4:17 PM, Jean Marc Saffroy jm@scality.com wrote:

Hi all,

Not sure what I'm doing wrong, but I couldn't find a way to store my docs
with timestamps as seconds since the Unix epoch and query them properly. I
have my date/time field mapped like this:

"start_time": {"type": "date" },

I store documents like this:

{ "start_time": 1427631731, ... }

And get no result when I do a range query like this:

"query": {
     "range": { "@timestamp": { "gte": "2015-03-29" }}
}

I have good results when I store timestamps as strings in ISO format.

Is that supposed to work? Is there a specific date parser I should use?

JM

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CALZqptZ16diE%2BOuChEKcYLu%2BwXL2ernqtOos3qDr6svvtkhMuw%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

3

Here is a curl recreation, hopefully that will be clearer:

JM

On Sun, Mar 29, 2015 at 4:18 PM, Jean Marc Saffroy jm@scality.com wrote:

Of course I left a typo in my email: I do use the same field name across
mapping def, docs and queries, and it does not work.

JM

On Sun, Mar 29, 2015 at 4:17 PM, Jean Marc Saffroy jm@scality.com wrote:

Hi all,

Not sure what I'm doing wrong, but I couldn't find a way to store my docs
with timestamps as seconds since the Unix epoch and query them properly. I
have my date/time field mapped like this:

"start_time": {"type": "date" },

I store documents like this:

{ "start_time": 1427631731, ... }

And get no result when I do a range query like this:

"query": {
     "range": { "@timestamp": { "gte": "2015-03-29" }}
}

I have good results when I store timestamps as strings in ISO format.

Is that supposed to work? Is there a specific date parser I should use?

JM

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CALZqptb5xZNgok4hiszEF9JP_KRuk6y%3DwdqfbjR0xxBesK4dBA%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

4

Unix epoch isn't a supported format. Take a look at

On 30 March 2015 at 02:12, Jean Marc Saffroy jm@scality.com wrote:

Here is a curl recreation, hopefully that will be clearer:
#!/bin/bashset -xcurl -X DELETE 'http://localhost:9200/test-foo?pretty' - Pastebin.com

JM

On Sun, Mar 29, 2015 at 4:18 PM, Jean Marc Saffroy jm@scality.com wrote:

Of course I left a typo in my email: I do use the same field name across
mapping def, docs and queries, and it does not work.

JM

On Sun, Mar 29, 2015 at 4:17 PM, Jean Marc Saffroy jm@scality.com
wrote:

Hi all,

Not sure what I'm doing wrong, but I couldn't find a way to store my
docs with timestamps as seconds since the Unix epoch and query them
properly. I have my date/time field mapped like this:

"start_time": {"type": "date" },

I store documents like this:

{ "start_time": 1427631731, ... }

And get no result when I do a range query like this:

"query": {
     "range": { "@timestamp": { "gte": "2015-03-29" }}
}

I have good results when I store timestamps as strings in ISO format.

Is that supposed to work? Is there a specific date parser I should use?

JM

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/CALZqptb5xZNgok4hiszEF9JP_KRuk6y%3DwdqfbjR0xxBesK4dBA%40mail.gmail.com
https://groups.google.com/d/msgid/elasticsearch/CALZqptb5xZNgok4hiszEF9JP_KRuk6y%3DwdqfbjR0xxBesK4dBA%40mail.gmail.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAEYi1X-v%3DM6ZVK1p%3Desb40QU_Va5beBpCVusGpKeoDpcht9c2Q%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

5

I thought I might have missed something, and it surprises me that the Unix
epoch isn't supported!

Well, I guess I'll have to work around that. Thanks!

JM

On Sun, Mar 29, 2015 at 10:21 PM, Mark Walkom markwalkom@gmail.com wrote:

Unix epoch isn't a supported format. Take a look at
format | Elasticsearch Guide [8.11] | Elastic

On 30 March 2015 at 02:12, Jean Marc Saffroy jm@scality.com wrote:

Here is a curl recreation, hopefully that will be clearer:
#!/bin/bashset -xcurl -X DELETE 'http://localhost:9200/test-foo?pretty' - Pastebin.com

JM

On Sun, Mar 29, 2015 at 4:18 PM, Jean Marc Saffroy jm@scality.com
wrote:

Of course I left a typo in my email: I do use the same field name across
mapping def, docs and queries, and it does not work.

JM

On Sun, Mar 29, 2015 at 4:17 PM, Jean Marc Saffroy jm@scality.com
wrote:

Hi all,

Not sure what I'm doing wrong, but I couldn't find a way to store my
docs with timestamps as seconds since the Unix epoch and query them
properly. I have my date/time field mapped like this:

"start_time": {"type": "date" },

I store documents like this:

{ "start_time": 1427631731, ... }

And get no result when I do a range query like this:

"query": {
     "range": { "@timestamp": { "gte": "2015-03-29" }}
}

I have good results when I store timestamps as strings in ISO format.

Is that supposed to work? Is there a specific date parser I should use?

JM

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/CALZqptb5xZNgok4hiszEF9JP_KRuk6y%3DwdqfbjR0xxBesK4dBA%40mail.gmail.com
https://groups.google.com/d/msgid/elasticsearch/CALZqptb5xZNgok4hiszEF9JP_KRuk6y%3DwdqfbjR0xxBesK4dBA%40mail.gmail.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/CAEYi1X-v%3DM6ZVK1p%3Desb40QU_Va5beBpCVusGpKeoDpcht9c2Q%40mail.gmail.com
https://groups.google.com/d/msgid/elasticsearch/CAEYi1X-v%3DM6ZVK1p%3Desb40QU_Va5beBpCVusGpKeoDpcht9c2Q%40mail.gmail.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CALZqptbGPcQDxUaFHfRfttdGyzFKVUogZEenj3nAPxOJYWitCw%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

6

Though support may be coming -

On 30 March 2015 at 09:16, Jean Marc Saffroy jm@scality.com wrote:

I thought I might have missed something, and it surprises me that the Unix
epoch isn't supported!

Well, I guess I'll have to work around that. Thanks!

JM

On Sun, Mar 29, 2015 at 10:21 PM, Mark Walkom markwalkom@gmail.com
wrote:

Unix epoch isn't a supported format. Take a look at
format | Elasticsearch Guide [8.11] | Elastic

On 30 March 2015 at 02:12, Jean Marc Saffroy jm@scality.com wrote:

Here is a curl recreation, hopefully that will be clearer:
#!/bin/bashset -xcurl -X DELETE 'http://localhost:9200/test-foo?pretty' - Pastebin.com

JM

On Sun, Mar 29, 2015 at 4:18 PM, Jean Marc Saffroy jm@scality.com
wrote:

Of course I left a typo in my email: I do use the same field name
across mapping def, docs and queries, and it does not work.

JM

On Sun, Mar 29, 2015 at 4:17 PM, Jean Marc Saffroy jm@scality.com
wrote:

Hi all,

Not sure what I'm doing wrong, but I couldn't find a way to store my
docs with timestamps as seconds since the Unix epoch and query them
properly. I have my date/time field mapped like this:

"start_time": {"type": "date" },

I store documents like this:

{ "start_time": 1427631731, ... }

And get no result when I do a range query like this:

"query": {
     "range": { "@timestamp": { "gte": "2015-03-29" }}
}

I have good results when I store timestamps as strings in ISO format.

Is that supposed to work? Is there a specific date parser I should use?

JM

--
You received this message because you are subscribed to the Google
Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send
an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/CALZqptb5xZNgok4hiszEF9JP_KRuk6y%3DwdqfbjR0xxBesK4dBA%40mail.gmail.com
https://groups.google.com/d/msgid/elasticsearch/CALZqptb5xZNgok4hiszEF9JP_KRuk6y%3DwdqfbjR0xxBesK4dBA%40mail.gmail.com?utm_medium=email&utm_source=footer
.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/CAEYi1X-v%3DM6ZVK1p%3Desb40QU_Va5beBpCVusGpKeoDpcht9c2Q%40mail.gmail.com
https://groups.google.com/d/msgid/elasticsearch/CAEYi1X-v%3DM6ZVK1p%3Desb40QU_Va5beBpCVusGpKeoDpcht9c2Q%40mail.gmail.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/elasticsearch/CALZqptbGPcQDxUaFHfRfttdGyzFKVUogZEenj3nAPxOJYWitCw%40mail.gmail.com
https://groups.google.com/d/msgid/elasticsearch/CALZqptbGPcQDxUaFHfRfttdGyzFKVUogZEenj3nAPxOJYWitCw%40mail.gmail.com?utm_medium=email&utm_source=footer
.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAEYi1X882n7C8-C5T8DQOgqf36PG%3D6ZaJaQ6%3DxWFGVEOVmK%3DvQ%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.