How to identify timefield of the index? - elasticsearch

Question

Is there a es query or some way to ask Elasticsearch that which field is being used as time field for a specific index?

Answer 1

You can use Kibana to choose the right time field (Step 5):
In Kibana, open Management, and then click Index Patterns.
If this is your first index pattern, the Create index pattern page opens automatically. Otherwise, click Create index pattern in the upper left.
Enter "your_index_name*" in the Index pattern field.
Click Next step
In Configure settings, select "#your_timestamp_field" in the Time Filter field name dropdown menu.
Click Create index pattern.
Kibana User Guide: Defining your index patterns
Or search in your index mapping for an field with "type: date"
curl 'http://localhost:9200/your_index/_mapping?pretty'
{
"your_index" : {
"mappings" : {
"your_index" : {
"properties" : {
"#**timestamp**" : {
"type" : "date"
},
"#version" : {
"type" : "text"
},
"clock" : {
"type" : "long"
},
"host" : {
"type" : "text"
},
"type" : {
"type" : "text"
}
}
}
}
}
}
Get Mapping
Or look into your indexed documents:
curl 'http://localhost:9200/your_index/_search?pretty'
{
"took" : 2,
"timed_out" : false,
"_shards" : {
"total" : 5,
"successful" : 5,
"failed" : 0
},
"hits" : {
"total" : 1,
"max_score" : 1.0,
"hits" : [
{
"_index" : "your_index",
"_type" : "your_index",
"_id" : "logstash-01.kvm.local",
"_score" : 1.0,
"_source" : {
"#timestamp" : "2018-11-10T18:03:22.822Z",
"host" : "logstash-01.kvm.local",
"#version" : "1",
"clock" : 558753,
"type" : "your_index"
}
}
]
}
}
Search API

Answer 2

When you have index already created and you want to check which field is used as a time field, navigate down to Management/Stack management/Index patterns, select your index and search through the fields. The field that is used as a time field has time (clock) icon next to it.