I tried to define the _timestamp
property on an index.
So first, I create the index
curl -XPUT 'http://elasticsearch:9200/ppe/'
response from the server : {"ok":true,"acknowledged":true}
then I tried to define the mapping with a _timestamp
curl -Xput 'http://elasticsearch:9200/ppe/log/_mapping' -d '{
"log": {
"properties": {
"_ttl": {
"enabled": true
},
"_timestamp": {
"enabled": true,
"store": "yes"
},
"message": {
"type": "string",
"store": "yes"
},
"appid": {
"type": "string",
"store": "yes"
},
"level": {
"type": "integer",
"store": "yes"
},
"logdate": {
"type": "date",
"format": "date_time_no_millis",
"store": "yes"
}
}
}
}'
and I receive as answer from the server
{
"error": "MapperParsingException[No type specified for property [_timestamp]]",
"status": 400
}
What's wrong with my mapping?
Special fields such as
_ttl
and_timestamp
have to be defined on the same level as theproperties
object:Note though that although
_timestamp
is defined on top level it will be returned insidefields
:Note that
_timestamp
must be explicitly requested byfields=_timestamp
orfields=_timestamp,_source
.Note that
_timestamp
can be returned only when this field is marked as'store': true
. But there is a way to access this value when sorting by_timestamp
, like this:Gives result:
And now
sort[0]
is the value for the first (and the only in this case) sort value:_timestamp
._timestamp
does not have to be marked as"store": true
when used in this manner.