_timestamp

The _timestamp field allows to automatically index the timestamp of a document. It can be provided externally via the index request or in the _source. If it is not provided externally it will be automatically set to a default date.

By default it is disabled. In order to enable it, the following mapping should be defined:

{
    "tweet" : {
        "_timestamp" : { "enabled" : true }
    }
}

By default the _timestamp field has store set to false and index set to not_analyzed. It can be queried as a standard date field.

The _timestamp value can be provided as an external value when indexing. But, it can also be automatically extracted from the document to index based on a path. For example, having the following mapping:

{
    "tweet" : {
        "_timestamp" : {
            "enabled" : true,
            "path" : "post_date"
        }
    }
}

Will cause 2009-11-15T14:12:12 to be used as the timestamp value for:

{
    "message" : "You know, for Search",
    "post_date" : "2009-11-15T14:12:12"
}

Note, using path without explicit timestamp value provided requires an additional (though quite fast) parsing phase.

You can define the date format used to parse the provided timestamp value. For example:

{
    "tweet" : {
        "_timestamp" : {
            "enabled" : true,
            "path" : "post_date",
            "format" : "YYYY-MM-dd"
        }
    }
}

Note, the default format is dateOptionalTime. The timestamp value will first be parsed as a number and if it fails the format will be tried.

You can define a default value for when timestamp is not provided within the index request or in the _source document.

By default, the default value is now which means the date the document was processed by the indexing chain.

You can reject documents which do not provide a timestamp value by setting ignore_missing to false (default to true):

{
    "tweet" : {
        "_timestamp" : {
            "enabled" : true,
            "ignore_missing" : false
        }
    }
}

You can also set the default value to any date respecting timestamp format:

{
    "tweet" : {
        "_timestamp" : {
            "enabled" : true,
            "format" : "YYYY-MM-dd",
            "default" : "1970-01-01"
        }
    }
}

If you don’t provide any timestamp value, _timestamp will be set to this default value.

In elasticsearch 1.4, we allowed setting explicitly "default":null which is not possible anymore as we added a new ignore_missing setting. When reading an index created with elasticsearch 1.4 and using this, we automatically update it by removing "default": null and setting "ignore_missing": false