Show proper date format in response on max aggregation over timestamp

[stha]

If you currently do a max aggregation on a date field, elasticsearch prints the output as a unix timestamp including milliseconds.

Example request:

{
...
"aggregations": {
    "last_hit": {
      "max": {
        "field": "@timestamp"
      }
    }
  }
...
}

Example current response:

{
...
 "aggregations": {
      "last_hit": {
         "value": 1404196200000
      }
   }
...
}

It would be more preferable if the output would be given in the following format:

Improved response:

{
...
 "aggregations": {
      "last_hit": {
         "value": "01.07.2014T06:30:00.000Z"
      }
   }
...
}

[antong]

I also got hit by this. Of course it feels like an unnecessary chore to decode what is left after max("2014-09-10T19:04:19.725694", "2014-09-10T11:12:13.432432") -> 1410375855.35215. However, the _source of the compared docs may have many different formats for the time stamp. So what should the result format be for max("2014-09-10T19:04:19.725694", 1410375055.1234, ...)?

If a string format is implemented, IMHO it must be ISO format without time zone and nothing else.

UPDATE/EDIT: Oh, with including milliseconds it means that the value is like UTC-milliseconds since UNIX epoch. Which really is surprising for the user. I first thought it really was a UNIX timestamp.

[bly2k]

Perhaps adding a format specifier just like in the date_histogram agg? I do agree this is a nice and useful feature to have.

{
"aggregations": {
    "last_hit": {
      "max": {
        "field": "@timestamp",
        "format": "YYYY-MM-dd"
      }
    }
  }
}