1/1/1970 blanked

[jimmyjones2]

eg:

curl -XPUT "localhost:9200/logs-2014.12.17/test/1" -d '
{ "@timestamp": "2014-12-17T13:36:30", "mydate": "1970-01-01T00:00:00Z", "test": "test2" }'

Think script_fields are to blame, maybe should use containsKey instead?

  "script_fields": {
    "@timestamp": {
      "script": "if (doc[\"@timestamp\"].value == 0) { null } else { doc[\"@timestamp\"].value }"
    },
    "mydate": {
      "script": "if (doc[\"mydate\"].value == 0) { null } else { doc[\"mydate\"].value }"
    }
  }

[rashidkpc]

In our testing doc.containsKey('@timestamp') doesn't actually work here as the elasticsearch date field defaults to 0, sort of. After bouncing the problem around with a few other engineers we came up with a solution that does:

doc['@timestamp'].value will return 0 on missing fields due to null_value casting, however we can abuse the fact that all fields are multi-valued and check the length of the array instead doc['@timestamp'].values.size() will return 0 for missing fields. Fix incoming.

[rashidkpc]

Scratch that, for our purposes here fielddata_fields: [] will work better.