Understanding how elasticsearch stores dates internally

Question

I would like to understand how ES stores date values ​​inside its indexes. Does it convert to UTC?

I have a type date field "t". Here's the mapping:

"t": { "type" : "date" }, 

Now, when I insert / add a document in ES, how it is stored in its indexes.

• "t": "1427700477165" (milliseconds generated by the Date.now () function). Does ES know the time of his era in UTC and saves how?

• "t": "2015-03-29T23: 59: 59" (I am changing the format of the match date accordingly) - how the ES saves this. If it is converted to UTC, how does it know what time zone this date is, and convert it to UTC? Does ES get the default time zone on the computer it is running on?

Thanks!

Answer 1

Internally (within the index), Elasticsearch saves all dates as numbers in epoch format, i.e. the number of milliseconds since January 01, 1970 00:00:00 GMT.

However, Elasticsearch also saves your raw JSON message by default, so when you return _source you will see everything that was sent to Elasticsearch.

To be able to import date strings into epoch format, you need to specify the format in your mapping, for example, or a predefined date format

 "t": { "type" : "date", "format" : "basic_date_time" } 

for yyyyMMdd'T'HHmmss.SSSZ .

or specify a custom date format :

 "t": { "type" : "date", "format" : "YYYY-MM-dd" } 

• If no format is specified, the default date parsing is ISODateTimeFormat.dateOptionalTimeParser .
• A display may indicate several date formats, for example. yyyy/MM/dd HH:mm:ss||yyyy/MM/dd
• If no time zone is specified, then Elasticsearch assumes UTC