Date field types in Elasticsearch

Introduction

Date field types help you store and search dates easily in Elasticsearch. They let you work with times and dates like birthdays or event times.

You want to save a user's birthday and find users born before a certain date.

You need to record when an event happened and search events by date range.

You want to sort documents by the date they were created.

You want to filter logs by specific time periods.

You want to calculate how old something is based on stored dates.

Syntax

Elasticsearch

PUT /my_index
{
  "mappings": {
    "properties": {
      "my_date": {
        "type": "date",
        "format": "yyyy-MM-dd||epoch_millis"
      }
    }
  }
}

The type must be set to date for date fields.

The format defines how dates are written and read. You can list multiple formats separated by ||.

Examples

This example stores dates in the format year-month-day like 2024-06-01.

Elasticsearch

PUT /events
{
  "mappings": {
    "properties": {
      "event_date": {
        "type": "date",
        "format": "yyyy-MM-dd"
      }
    }
  }
}

This example stores dates as milliseconds since 1970-01-01 (epoch time).

Elasticsearch

PUT /logs
{
  "mappings": {
    "properties": {
      "timestamp": {
        "type": "date",
        "format": "epoch_millis"
      }
    }
  }
}

This example accepts three date formats for the same field.

Elasticsearch

PUT /mixed_dates
{
  "mappings": {
    "properties": {
      "date_field": {
        "type": "date",
        "format": "yyyy-MM-dd||yyyy/MM/dd||epoch_millis"
      }
    }
  }
}

Sample Program

This program creates an index with a date field that accepts two formats. It adds two documents with dates in different formats. Then it searches for documents created on June 1, 2024.

Elasticsearch

PUT /my_index
{
  "mappings": {
    "properties": {
      "created_at": {
        "type": "date",
        "format": "yyyy-MM-dd HH:mm:ss||epoch_millis"
      }
    }
  }
}

POST /my_index/_doc
{
  "created_at": "2024-06-01 14:30:00"
}

POST /my_index/_doc
{
  "created_at": 1717252200000
}

GET /my_index/_search
{
  "query": {
    "range": {
      "created_at": {
        "gte": "2024-06-01 00:00:00",
        "lte": "2024-06-02 00:00:00"
      }
    }
  }
}

Important Notes

Always specify the date format if your dates are not in the default ISO format.

Elasticsearch stores dates internally as milliseconds since epoch, no matter the input format.

Using multiple formats helps when your data comes from different sources.

Summary

Date fields store time and date information in Elasticsearch.

You define the format so Elasticsearch knows how to read your dates.

You can search, sort, and filter documents by date easily.

Practice

1. What is the primary purpose of a date field type in Elasticsearch?

easy

A. To store and query time and date information

B. To store large text documents

C. To perform mathematical calculations

D. To store binary data

Solution

1. Step 1: Understand the role of field types in Elasticsearch

   Field types define how data is stored and interpreted in Elasticsearch.

2. Step 2: Identify the function of the date field type

   The date field type specifically stores time and date information for searching and sorting.

3. Final Answer:

   To store and query time and date information -> Option A

4. Quick Check:

   Date field = store time/date [OK]

Hint: Date fields store time info, not text or numbers [OK]

Common Mistakes:

• Confusing date fields with text fields
• Thinking date fields store binary data
• Assuming date fields perform calculations

2. Which of the following is the correct way to define a date field with a custom format in an Elasticsearch mapping?

easy

A. {
"mappings": {
"properties": {
"created_at": {"type": "integer", "format": "yyyy-MM-dd"}
}
}
}

B. {
"mappings": {
"properties": {
"created_at": {"type": "date", "format": "yyyy-MM-dd HH:mm:ss"}
}
}
}

C. {
"mappings": {
"properties": {
"created_at": {"type": "date"}
}
}
}

D. {
"mappings": {
"properties": {
"created_at": {"type": "text", "format": "yyyy-MM-dd"}
}
}
}

Solution

1. Step 1: Check the field type for date

   The field must have type set to date to store dates.

2. Step 2: Verify the format property

   Custom date formats are specified with the format key inside the date field definition.

3. Final Answer:

   Mapping with type 'date' and format 'yyyy-MM-dd HH:mm:ss' -> Option B

4. Quick Check:

   Date type + format key = correct mapping [OK]

Hint: Date fields need type 'date' and format string [OK]

Common Mistakes:

• Using type 'text' or 'integer' for date fields
• Omitting the format when using custom date strings
• Placing format outside the date field definition

3. Given this Elasticsearch mapping and document, what will be the stored value for the event_date field?

{
  "mappings": {
    "properties": {
      "event_date": { "type": "date", "format": "yyyy/MM/dd" }
    }
  }
}

Document:
{
  "event_date": "2024/06/15"
}

medium

A. Error: Invalid date format

B. "2024/06/15"

C. "2024-06-15T00:00:00.000Z"

D. "15-06-2024"

Solution

1. Step 1: Understand the mapping format

   The mapping expects dates in the format "yyyy/MM/dd" which matches the document date "2024/06/15".

2. Step 2: Know how Elasticsearch stores dates internally

   Elasticsearch converts dates to ISO 8601 format with time and timezone, so it stores "2024-06-15T00:00:00.000Z".

3. Final Answer:

   "2024-06-15T00:00:00.000Z" -> Option C

4. Quick Check:

   Input format matches mapping, stored as ISO date [OK]

Hint: Input matches format, stored as ISO 8601 date [OK]

Common Mistakes:

• Expecting stored value to keep original format
• Thinking Elasticsearch stores raw string
• Confusing format mismatch errors

4. You defined a date field with format yyyy-MM-dd but indexing documents with dates like 2024/06/15 causes errors. What is the best fix?

medium

A. Change the mapping format to include yyyy/MM/dd

B. Convert all dates to yyyy-MM-dd before indexing

C. Change the field type to text

D. Remove the format from the mapping

Solution

1. Step 1: Identify the cause of the error

   The document dates use slashes / but the mapping expects dashes -, causing format mismatch errors.

2. Step 2: Fix the mapping to accept the document date format

   Update the mapping format to include yyyy/MM/dd so Elasticsearch can parse the input dates correctly.

3. Final Answer:

   Change the mapping format to include yyyy/MM/dd -> Option A

4. Quick Check:

   Mapping format must match input date format [OK]

Hint: Mapping format must match input date format exactly [OK]

Common Mistakes:

• Changing field type to text loses date features
• Removing format causes parsing errors if format differs
• Not updating mapping when input format changes

5. You want to index documents with multiple date fields: created_at in ISO format and due_date in dd-MM-yyyy format. How should you define the mapping to handle both correctly?

hard

A. {
"mappings": {
"properties": {
"created_at": { "type": "date", "format": "dd-MM-yyyy" },
"due_date": { "type": "date" }
}
}
}

B. {
"mappings": {
"properties": {
"created_at": { "type": "date", "format": "dd-MM-yyyy" },
"due_date": { "type": "date", "format": "dd-MM-yyyy" }
}
}
}

C. {
"mappings": {
"properties": {
"created_at": { "type": "text" },
"due_date": { "type": "text" }
}
}
}

D. {
"mappings": {
"properties": {
"created_at": { "type": "date" },
"due_date": { "type": "date", "format": "dd-MM-yyyy" }
}
}
}

Solution

1. Step 1: Understand the formats of each date field

   created_at uses ISO format (default), due_date uses custom dd-MM-yyyy format.

2. Step 2: Define mapping with correct formats per field

   Set created_at as date with default format, and due_date as date with format: dd-MM-yyyy.

3. Final Answer:

   Mapping with default date for created_at and custom format for due_date -> Option D

4. Quick Check:

   Each date field needs correct format in mapping [OK]

Hint: Set format per date field to match its input format [OK]

Common Mistakes:

• Using text type instead of date loses date features
• Applying wrong format to a field causes parsing errors
• Using same format for different date formats