Hi, I don't understand why, but when I changed "time_raw"'s index as "not_analyzed", it worked.
{ "tempalte_blahblah" : { "template" : "logstash*", "mappings" : { "blah" : { "properties" : { "hostname": { "type": "string", "index":"not_analyzed" }, "time_raw": { "type": "date", "index": "not_analyzed", "format": "yyyy-MM-dd HH:mm:ss.SSS" } } } } } I really need to study hard behavior of elasticsearch, thanks. -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/1e05e3aa-0756-44f6-bb92-f874ef8fe3b4%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.