Date field types in Elasticsearch - Step-by-Step Execution

Concept Flow - Date field types

Define mapping with date field

↓

Index document with date value

↓

Elasticsearch parses date

↓

Stores date as milliseconds since epoch

↓

Date queries use stored format

↓

Return matching documents

This flow shows how Elasticsearch handles date fields: defining the field, indexing documents, parsing dates, storing them internally, and querying.

Execution Sample

Elasticsearch

PUT my_index
{
  "mappings": {
    "properties": {
      "created_at": { "type": "date" }
    }
  }
}

PUT my_index/_doc/1
{
  "created_at": "2024-06-01T12:00:00Z"
}

Defines an index with a date field and indexes a document with an ISO 8601 date string.

Execution Table

Step	Action	Input/Condition	Result/Output
1	Define index mapping	Field 'created_at' type=date	Mapping stored with date field type
2	Index document	created_at='2024-06-01T12:00:00Z'	Date string accepted
3	Parse date	Parse '2024-06-01T12:00:00Z'	Parsed to milliseconds since epoch (e.g. 1717243200000)
4	Store date	Store parsed milliseconds	Date stored internally as long integer
5	Query date	Search for documents with date range	Documents with matching date returned
6	Exit	No more documents	Index ready for date queries

💡 All steps complete; date field indexed and ready for queries

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	Final
created_at	undefined	"2024-06-01T12:00:00Z"	1717243200000 (ms)	1717243200000 (stored)	1717243200000 (stored)

Key Moments - 3 Insights

Why does Elasticsearch store dates as numbers instead of strings?

Elasticsearch converts date strings to milliseconds since epoch (see Step 3 in execution_table) to enable fast range queries and sorting.

What happens if the date format in the document doesn't match the expected format?

Elasticsearch will fail to parse the date and reject the document or field update (not shown in this trace but parsing is critical at Step 3).

Can you store dates in formats other than ISO 8601?

Yes, but you must specify the format in the mapping so Elasticsearch can parse it correctly during Step 3.

Visual Quiz - 3 Questions

Look at the execution_table, what is the value of 'created_at' after Step 3?

A Milliseconds since epoch (e.g. 1717243200000)

B The original date string '2024-06-01T12:00:00Z'

C A formatted date string like 'June 1, 2024'

D Undefined

💡 Hint

Check the 'Result/Output' column in Step 3 of the execution_table.

At which step does Elasticsearch store the date internally as a number?

A Step 2

B Step 3

C Step 4

D Step 5

💡 Hint

Look for the step where the date is 'stored internally as long integer' in the execution_table.

If you index a document with a date in a custom format without updating the mapping, what will happen?

A Elasticsearch will parse it correctly anyway

B The document will be rejected due to parsing error

C The date will be stored as a string

D The date will be ignored silently

💡 Hint

Refer to the key_moments section about date format parsing and errors.

Concept Snapshot

Date field types in Elasticsearch:
- Define date fields in mapping with "type": "date"
- Index date strings (default ISO 8601)
- Elasticsearch parses dates to milliseconds since epoch
- Stores dates as long integers internally
- Enables fast date range queries and sorting
- Custom formats require mapping update

Full Transcript

This visual trace shows how Elasticsearch handles date field types. First, you define a mapping with a date field. Then, when you index a document with a date string, Elasticsearch parses that string into milliseconds since the epoch (January 1, 1970). It stores this number internally for efficient searching and sorting. Queries on date fields use this stored format to quickly find matching documents. If the date format does not match the expected format, Elasticsearch will reject the document. Custom date formats can be supported by specifying them in the mapping. This process ensures dates are handled consistently and efficiently.

Practice

1. What is the primary purpose of a date field type in Elasticsearch?

easy

A. To store and query time and date information

B. To store large text documents

C. To perform mathematical calculations

D. To store binary data

Solution

1. Step 1: Understand the role of field types in Elasticsearch

   Field types define how data is stored and interpreted in Elasticsearch.

2. Step 2: Identify the function of the date field type

   The date field type specifically stores time and date information for searching and sorting.

3. Final Answer:

   To store and query time and date information -> Option A

4. Quick Check:

   Date field = store time/date [OK]

Hint: Date fields store time info, not text or numbers [OK]

Common Mistakes:

• Confusing date fields with text fields
• Thinking date fields store binary data
• Assuming date fields perform calculations

2. Which of the following is the correct way to define a date field with a custom format in an Elasticsearch mapping?

easy

A. {
"mappings": {
"properties": {
"created_at": {"type": "integer", "format": "yyyy-MM-dd"}
}
}
}

B. {
"mappings": {
"properties": {
"created_at": {"type": "date", "format": "yyyy-MM-dd HH:mm:ss"}
}
}
}

C. {
"mappings": {
"properties": {
"created_at": {"type": "date"}
}
}
}

D. {
"mappings": {
"properties": {
"created_at": {"type": "text", "format": "yyyy-MM-dd"}
}
}
}

Solution

1. Step 1: Check the field type for date

   The field must have type set to date to store dates.

2. Step 2: Verify the format property

   Custom date formats are specified with the format key inside the date field definition.

3. Final Answer:

   Mapping with type 'date' and format 'yyyy-MM-dd HH:mm:ss' -> Option B

4. Quick Check:

   Date type + format key = correct mapping [OK]

Hint: Date fields need type 'date' and format string [OK]

Common Mistakes:

• Using type 'text' or 'integer' for date fields
• Omitting the format when using custom date strings
• Placing format outside the date field definition

3. Given this Elasticsearch mapping and document, what will be the stored value for the event_date field?

{
  "mappings": {
    "properties": {
      "event_date": { "type": "date", "format": "yyyy/MM/dd" }
    }
  }
}

Document:
{
  "event_date": "2024/06/15"
}

medium

A. Error: Invalid date format

B. "2024/06/15"

C. "2024-06-15T00:00:00.000Z"

D. "15-06-2024"

Solution

1. Step 1: Understand the mapping format

   The mapping expects dates in the format "yyyy/MM/dd" which matches the document date "2024/06/15".

2. Step 2: Know how Elasticsearch stores dates internally

   Elasticsearch converts dates to ISO 8601 format with time and timezone, so it stores "2024-06-15T00:00:00.000Z".

3. Final Answer:

   "2024-06-15T00:00:00.000Z" -> Option C

4. Quick Check:

   Input format matches mapping, stored as ISO date [OK]

Hint: Input matches format, stored as ISO 8601 date [OK]

Common Mistakes:

• Expecting stored value to keep original format
• Thinking Elasticsearch stores raw string
• Confusing format mismatch errors

4. You defined a date field with format yyyy-MM-dd but indexing documents with dates like 2024/06/15 causes errors. What is the best fix?

medium

A. Change the mapping format to include yyyy/MM/dd

B. Convert all dates to yyyy-MM-dd before indexing

C. Change the field type to text

D. Remove the format from the mapping

Solution

1. Step 1: Identify the cause of the error

   The document dates use slashes / but the mapping expects dashes -, causing format mismatch errors.

2. Step 2: Fix the mapping to accept the document date format

   Update the mapping format to include yyyy/MM/dd so Elasticsearch can parse the input dates correctly.

3. Final Answer:

   Change the mapping format to include yyyy/MM/dd -> Option A

4. Quick Check:

   Mapping format must match input date format [OK]

Hint: Mapping format must match input date format exactly [OK]

Common Mistakes:

• Changing field type to text loses date features
• Removing format causes parsing errors if format differs
• Not updating mapping when input format changes

5. You want to index documents with multiple date fields: created_at in ISO format and due_date in dd-MM-yyyy format. How should you define the mapping to handle both correctly?

hard

A. {
"mappings": {
"properties": {
"created_at": { "type": "date", "format": "dd-MM-yyyy" },
"due_date": { "type": "date" }
}
}
}

B. {
"mappings": {
"properties": {
"created_at": { "type": "date", "format": "dd-MM-yyyy" },
"due_date": { "type": "date", "format": "dd-MM-yyyy" }
}
}
}

C. {
"mappings": {
"properties": {
"created_at": { "type": "text" },
"due_date": { "type": "text" }
}
}
}

D. {
"mappings": {
"properties": {
"created_at": { "type": "date" },
"due_date": { "type": "date", "format": "dd-MM-yyyy" }
}
}
}

Solution

1. Step 1: Understand the formats of each date field

   created_at uses ISO format (default), due_date uses custom dd-MM-yyyy format.

2. Step 2: Define mapping with correct formats per field

   Set created_at as date with default format, and due_date as date with format: dd-MM-yyyy.

3. Final Answer:

   Mapping with default date for created_at and custom format for due_date -> Option D

4. Quick Check:

   Each date field needs correct format in mapping [OK]

Hint: Set format per date field to match its input format [OK]

Common Mistakes:

• Using text type instead of date loses date features
• Applying wrong format to a field causes parsing errors
• Using same format for different date formats