在kibana上将字段编号转换为日期，进行弹性搜索

Question

I've a field number on Elasticsearch via Kibana.

This is an example field:

"insert.datePeticio:1,546,185,770,733"

I need to convert this field to date, for visualize purpose.

How can I parse it to date mode?

Answer 1

As far as I understand, you have an integer field on Elasticsearch that stores date/time in milliseconds since the epoch. You would like to convert it to an appropriate date type to visualise on Kibana properly. In this case, I would recommend two solutions:

1) If you are able to define a mapping, use the the following for insert.datePeticio field:

"mappings": {
  "_doc": {
    "properties": {
      "insert.datePeticio": {
        "format": "epoch_millis",
        "type": "date"
      }
    }
  }
}

This allows Kibana to define and represent insert.datePeticio field as date even though the actual value is store in miliseconds as integer on Elasticsearch.

2) If not, so cannot make any changes on the original mapping, create a scripted field on Kibana as follows:

• Go to Management > Index Patterns
• Select the Index Pattern you want to modify
• Select the index pattern's Scripted Fields tab
• Click Add Scripted Field
• Fill the form referring to the image below, and Save it.

If you go to Kibana > Discover , you can see two fields together in different representations and types: insert.datePeticio: 1,546,185,770,733 and insert.datePeticio_UTC:December 30th 2018, 16:02:50.733 . Since being a date type, the scripted field insert.datePeticio_UTC can be easily used to create visualisations based on date aggregations.

Note: Scripted fields compute data on the fly from the data in your Elasticsearch indices. Keep in mind that computing data on the fly with scripted fields can be very resource intensive and can have a direct impact on Kibana's performance.