Visualize: bucket aggregation on date histogram: click on charts to set a filter makes an error

(Christophe Spielmann) #1

Kibana 4.2.0 / ES 2.0.0

Visualize tab -> histogram:
Y-Axis : count
Buckets - Split chart
date histogram ( on a usual date field)
Interval: yearly.

-> display is very fine, but when I click on a chart to set up a filter I got the following error.
Why is the display fine but the date of the filter fails

Error: Request to Elasticsearch failed: {"error":{"root_cause":[{"type":"parse_exception","reason":"failed to parse date field [1325372400000] with format [dd-MMM-yyyy HH:mm:ss]"}],"type":"search_phase_execution_exception","reason":"all shards failed","phase":"query","grouped":true,"failed_shards":[{"shard":0,"index":"kibana_samplewithparticipant","node":"RBGZvMDbQhaZbxY8oYDvvQ","reason":{"type":"parse_exception","reason":"failed to parse date field [1325372400000] with format [dd-MMM-yyyy HH:mm:ss]","caused_by":{"type":"illegal_argument_exception","reason":"Invalid format: "1325372400000" is malformed at "25372400000""}}}]}}
at http://xxx:5601/bundles/kibana.bundle.js:86524:39
at Function.Promise.try (http://xxx:5601/bundles/commons.bundle.js:56927:23)
at http://xxxx:5601/bundles/commons.bundle.js:56896:31
at (native)
at (http://xxxx:5601/bundles/commons.bundle.js:56895:31)
at callResponseHandlers (http://xxxx:5601/bundles/kibana.bundle.js:86496:23)
at http://xxxx:5601/bundles/kibana.bundle.js:86020:17
at wrappedCallback (http://xxxx:5601/bundles/commons.bundle.js:38613:82)
at wrappedCallback (http://xxxx:5601/bundles/commons.bundle.js:38613:82)
at http://xxxx:5601/bundles/commons.bundle.js:38699:27

my mapping is:
"sample_audit_date": {
"path_match": "audits.((?!Collection).*).date",
"match_pattern": "regex",
"mapping": {
"type": "date",
"format": "dd-MMM-yyyy HH:mm:ss",
"ignore_malformed": "true",
"doc_values": true

I am not able yet to find any rationale around that.

(Joe Fleming) #2

There's definitely something wrong there with the timestamp being passed into that query. 1325372400000 isn't a valid epoch time, it looks like a Javascript time (which is essentially epoch * 1000).

Have you tried running a newer version of 4.2 (4.2.2 is the most recent 4.2 version) to see if this issue still exists there? I did a quick search to find that error in the issue list, and didn't find it, but it may very well be that my cursory look was not enough.

(system) #3