Date field types in Elasticsearch - Time & Space Complexity

Time Complexity: Date field types

O(n)

Understanding Time Complexity

When working with date fields in Elasticsearch, it's important to understand how queries process these fields.

We want to know how the time to search or filter by dates grows as the data size increases.

Scenario Under Consideration

Analyze the time complexity of the following Elasticsearch query filtering documents by a date range.

GET /events/_search
{
  "query": {
    "range": {
      "event_date": {
        "gte": "2023-01-01",
        "lte": "2023-12-31"
      }
    }
  }
}
    

This query finds all documents where the event_date falls within the year 2023.

Identify Repeating Operations

Look at what happens when Elasticsearch runs this query.

• Primary operation: Elasticsearch checks the date field in each document to see if it fits the range.
• How many times: This check happens for every document in the index or matching shard.

How Execution Grows With Input

As the number of documents grows, Elasticsearch must check more date fields.

Input Size (n)	Approx. Operations
10	10 date checks
100	100 date checks
1000	1000 date checks

Pattern observation: The number of operations grows directly with the number of documents.

Final Time Complexity

Time Complexity: O(n)

This means the time to filter by date grows in a straight line as the number of documents increases.

Common Mistake

[X] Wrong: "Filtering by date is instant no matter how many documents there are."

[OK] Correct: Elasticsearch still needs to check each document's date field to see if it matches the range, so more documents mean more work.

Interview Connect

Understanding how queries scale with data size helps you design better searches and explain performance clearly.

Self-Check

"What if the date field was indexed with a different format or precision? How would that affect the time complexity?"

Practice

1. What is the primary purpose of a date field type in Elasticsearch?

easy

A. To store and query time and date information

B. To store large text documents

C. To perform mathematical calculations

D. To store binary data

Solution

1. Step 1: Understand the role of field types in Elasticsearch

   Field types define how data is stored and interpreted in Elasticsearch.

2. Step 2: Identify the function of the date field type

   The date field type specifically stores time and date information for searching and sorting.

3. Final Answer:

   To store and query time and date information -> Option A

4. Quick Check:

   Date field = store time/date [OK]

Hint: Date fields store time info, not text or numbers [OK]

Common Mistakes:

• Confusing date fields with text fields
• Thinking date fields store binary data
• Assuming date fields perform calculations

2. Which of the following is the correct way to define a date field with a custom format in an Elasticsearch mapping?

easy

A. {
"mappings": {
"properties": {
"created_at": {"type": "integer", "format": "yyyy-MM-dd"}
}
}
}

B. {
"mappings": {
"properties": {
"created_at": {"type": "date", "format": "yyyy-MM-dd HH:mm:ss"}
}
}
}

C. {
"mappings": {
"properties": {
"created_at": {"type": "date"}
}
}
}

D. {
"mappings": {
"properties": {
"created_at": {"type": "text", "format": "yyyy-MM-dd"}
}
}
}

Solution

1. Step 1: Check the field type for date

   The field must have type set to date to store dates.

2. Step 2: Verify the format property

   Custom date formats are specified with the format key inside the date field definition.

3. Final Answer:

   Mapping with type 'date' and format 'yyyy-MM-dd HH:mm:ss' -> Option B

4. Quick Check:

   Date type + format key = correct mapping [OK]

Hint: Date fields need type 'date' and format string [OK]

Common Mistakes:

• Using type 'text' or 'integer' for date fields
• Omitting the format when using custom date strings
• Placing format outside the date field definition

3. Given this Elasticsearch mapping and document, what will be the stored value for the event_date field?

{
  "mappings": {
    "properties": {
      "event_date": { "type": "date", "format": "yyyy/MM/dd" }
    }
  }
}

Document:
{
  "event_date": "2024/06/15"
}

medium

A. Error: Invalid date format

B. "2024/06/15"

C. "2024-06-15T00:00:00.000Z"

D. "15-06-2024"

Solution

1. Step 1: Understand the mapping format

   The mapping expects dates in the format "yyyy/MM/dd" which matches the document date "2024/06/15".

2. Step 2: Know how Elasticsearch stores dates internally

   Elasticsearch converts dates to ISO 8601 format with time and timezone, so it stores "2024-06-15T00:00:00.000Z".

3. Final Answer:

   "2024-06-15T00:00:00.000Z" -> Option C

4. Quick Check:

   Input format matches mapping, stored as ISO date [OK]

Hint: Input matches format, stored as ISO 8601 date [OK]

Common Mistakes:

• Expecting stored value to keep original format
• Thinking Elasticsearch stores raw string
• Confusing format mismatch errors

4. You defined a date field with format yyyy-MM-dd but indexing documents with dates like 2024/06/15 causes errors. What is the best fix?

medium

A. Change the mapping format to include yyyy/MM/dd

B. Convert all dates to yyyy-MM-dd before indexing

C. Change the field type to text

D. Remove the format from the mapping

Solution

1. Step 1: Identify the cause of the error

   The document dates use slashes / but the mapping expects dashes -, causing format mismatch errors.

2. Step 2: Fix the mapping to accept the document date format

   Update the mapping format to include yyyy/MM/dd so Elasticsearch can parse the input dates correctly.

3. Final Answer:

   Change the mapping format to include yyyy/MM/dd -> Option A

4. Quick Check:

   Mapping format must match input date format [OK]

Hint: Mapping format must match input date format exactly [OK]

Common Mistakes:

• Changing field type to text loses date features
• Removing format causes parsing errors if format differs
• Not updating mapping when input format changes

5. You want to index documents with multiple date fields: created_at in ISO format and due_date in dd-MM-yyyy format. How should you define the mapping to handle both correctly?

hard

A. {
"mappings": {
"properties": {
"created_at": { "type": "date", "format": "dd-MM-yyyy" },
"due_date": { "type": "date" }
}
}
}

B. {
"mappings": {
"properties": {
"created_at": { "type": "date", "format": "dd-MM-yyyy" },
"due_date": { "type": "date", "format": "dd-MM-yyyy" }
}
}
}

C. {
"mappings": {
"properties": {
"created_at": { "type": "text" },
"due_date": { "type": "text" }
}
}
}

D. {
"mappings": {
"properties": {
"created_at": { "type": "date" },
"due_date": { "type": "date", "format": "dd-MM-yyyy" }
}
}
}

Solution

1. Step 1: Understand the formats of each date field

   created_at uses ISO format (default), due_date uses custom dd-MM-yyyy format.

2. Step 2: Define mapping with correct formats per field

   Set created_at as date with default format, and due_date as date with format: dd-MM-yyyy.

3. Final Answer:

   Mapping with default date for created_at and custom format for due_date -> Option D

4. Quick Check:

   Each date field needs correct format in mapping [OK]

Hint: Set format per date field to match its input format [OK]

Common Mistakes:

• Using text type instead of date loses date features
• Applying wrong format to a field causes parsing errors
• Using same format for different date formats