Kibana 7.14 | Date Format - Is it possible to store Dates in Epoch format but display it in ISO Date format in Kibana Search queries

user_2533109 0
Viewed 43

Is it possible to Store the Date in Epoch format but display it in ISO Date format within the Kibana search queries?

Note - The below diagram depicts how the date should be displayed in different places. Most questions on stack overflow are just about changing formats when writing into ES but I am wondering if there is a way to change the format when the date is displaying in Kibana.

enter image description here

kibana elasticsearch
1 Answers

An easy way to do it is by using script_fields like this:

GET test/_search
{
  "script_fields": {
    "date_iso": {
      "script": {
        "source": "doc.date.value"
      }
    }
  }
}

Results =>

  {
    "_index" : "test",
    "_type" : "_doc",
    "_id" : "1",
    "_score" : 1.0,
    "_source" : {
      "date" : "1635972005107"
    },
    "fields" : {
      "date_iso" : [
        "2021-11-03T20:40:05.107Z"
      ]
    }
  }

As you can see, even though the date field is stored in epoch format, the date_iso script field is returned in ISO8601 format.

You can also use the Fields API to return the date with the given format:

GET test/_search
{
  "fields": [
    {
      "field": "date",
      "format": "date_time" 
    }
  ]
}

Results =>

  {
    "_index" : "test",
    "_type" : "_doc",
    "_id" : "1",
    "_score" : 1.0,
    "_source" : {
      "date" : "1635972005107"
    },
    "fields" : {
      "date" : [
        "2021-11-03T20:40:05.107Z"
      ]
    }
  }
user_46045790
Related