Using date value in script converts to double before evaluation?

Elastic Stack Kibana
1

I'm listing a bunch of Max @timestamp in a data table under a series of filters, and I'd rather see them as "time since" than the timestamps to more quickly identify potential problems.

Seems like a great use for a script! But when I run a script "DateTime.now() - _value", either inline or indexed, it throws an error:

No signature of method: org.joda.time.DateTime.minus() is applicable for argument types: (java.lang.Double) values: [1.474109352E12]

Whoa! Since when was my epoch_millis a double? I tried "DateTime.now() - new DateTime(_value)" and it complains similarly: _value is a double.

2

It looks like ES chokes on epoch_millis-length longs and that's what's causing the value to get turned into a double. For this case I don't need exact milliseconds, so I can use Math.round(_value) to get a long into this calculation, which will result in 3 digits of precision loss.

Unfortunately DateTime.now().getMillis()-Math.round(_value) winds up looking like January 30th, 1970, so I'll have to find a way to fashion it into a duration. Hopefully the inclusion of duration fields and Painless including Java 8's Joda-inspired time library will make this easier soon.