Kibana doesn't support aggregations by date fields even though Elasticsearch support it. In the objects page, the visualization can be changed to allow aggregation by date, but Kibana does use the value_as_string field in the response. For example, for the following aggregate:
{
...,
"aggs": {
"2": {
"terms": {
"field": "host",
"size": 1000,
"order": {
"1": "desc"
}
},
"aggs": {
"1": {
"max": {
"field": "@timestamp"
}
}
}
}
},
...
}
The following response is returned:
{
...,
"aggregations" : {
"2" : {
"doc_count_error_upper_bound" : 0,
"sum_other_doc_count" : 0,
"buckets" : [
{
"1" : {
"value" : 1431649893353,
"value_as_string" : "2015-05-15T00:31:33.353Z"
},
"key" : "SERVER",
"doc_count" : 34278
}
]
}
},
...
}
The result in Kibana as a datagrid is:
Please enable both support for aggregations on date and choosing to use the value_as_string for display.
Kibana doesn't support aggregations by date fields even though Elasticsearch support it. In the objects page, the visualization can be changed to allow aggregation by date, but Kibana does use the value_as_string field in the response. For example, for the following aggregate:
The following response is returned:
The result in Kibana as a datagrid is:
Please enable both support for aggregations on date and choosing to use the value_as_string for display.