Returning the timestamp field in elasticsearch

Question

Why can I not see the _timestamp field while being able to filter a query by it?

The following query return the correct documents, but not the timestamp itself. How

Answer 1

It is not necessary to store the timestamp field, since its exact value is preserved as a term, which is also more likely to already be present in RAM, especially if you are querying on it. You can access the timestamp via its term using a script_value:

{
    "query": {
        ...
    },
    "script_fields": {
        "timestamp": {
            "script": "_doc['_timestamp'].value"
        }
    }
}

The resulting value is expressed in miliseconds since UNIX epoch. It's quite obscene that ElasticSearch can't do this for you, but hey, nothing's perfect.

Answer 2

When timestamp field is enabled, it's indexed but not stored by default. So, while you can search and filter by the timestamp field, you cannot easily retrieve it with your records. In order to be able to retrieve the timestamp field you need to recreate your index with the following mapping:

{
    "my_doctype": {
        "_timestamp": {
            "enabled": "true",
            "store": "yes"
        },
        "properties": {
            ...
        }
    }
}

This way you will be able to retrieve timestamp as the number of milliseconds since the epoch.