The _timestamp field allows to automatically index the timestamp of a document. It can be provided externally via the index request or in the _source. If it is not provided externally it will be automatically set to a default date.

enablededit

By default it is disabled. In order to enable it, the following mapping should be defined:

{
    "tweet" : {
        "_timestamp" : { "enabled" : true }
    }
}

store / indexedit

By default the _timestamp field has store set to false and index set to not_analyzed. It can be queried as a standard date field.

pathedit

The _timestamp value can be provided as an external value when indexing. But, it can also be automatically extracted from the document to index based on a path. For example, having the following mapping:

{
    "tweet" : {
        "_timestamp" : {
            "enabled" : true,
            "path" : "post_date"
        }
    }
}

Will cause 2009-11-15T14:12:12 to be used as the timestamp value for:

{
    "message" : "You know, for Search",
    "post_date" : "2009-11-15T14:12:12"
}

Note, using path without explicit timestamp value provided requires an additional (though quite fast) parsing phase.

formatedit

You can define the date format used to parse the provided timestamp value. For example:

{
    "tweet" : {
        "_timestamp" : {
            "enabled" : true,
            "path" : "post_date",
            "format" : "YYYY-MM-dd"
        }
    }
}

Note, the default format is dateOptionalTime. The timestamp value will first be parsed as a number and if it fails the format will be tried.

defaultedit

You can define a default value for when timestamp is not provided within the index request or in the _source document.

By default, the default value is now which means the date the document was processed by the indexing chain.

You can reject documents which do not provide a timestamp value by setting ignore_missing to false (default to true):

{
    "tweet" : {
        "_timestamp" : {
            "enabled" : true,
            "ignore_missing" : false
        }
    }
}

You can also set the default value to any date respecting timestamp format:

{
    "tweet" : {
        "_timestamp" : {
            "enabled" : true,
            "format" : "YYYY-MM-dd",
            "default" : "1970-01-01"
        }
    }
}

If you don’t provide any timestamp value, _timestamp will be set to this default value.