Hello,
we started sending phabricator events to elasticsearch. We noticed that some timestamp fileds contain unix epoch values in seconds.
Additionally, <_timestamp> and <dateCreated> fields are mapped as "string" type and <when> fields mapped as "long" type. Let me suggest the following changes:
1. fields that contain timestamp fields to be mapped as "date" type fields
2. unix epoch timestamps to be encoded in milliseconds and not in seconds. That way, an elasticsearch user who wants to visualize these events in Kibana/Grafana will not need to modify the date format of the field. Also, epoch_second format is only supported in Elasticsearch 2 and above.
That way, theoretically, there will be no need for changing the mapping of phabricator index types (TASK, DREV, CMIT)
Best regards,
Kostis