title: ElasticSearch / Kibana timestamp - field or _source?
body: <p>My single raw document in ES/Kibana looks like this:</p>
  
  <pre><code>{
    "_index": "fluentd.apache.access.20191202",
    "_type": "_doc",
    "_id": "8jql724B3OrCHx56JnWb",
    "_score": 1,
    "_source": {
      "serveraddress": "....",
      "clientaddress": "...",
      "@timestamp": "2019-12-02T11:00:30+0000",
      "method": "GET",
      "url": "....",
      "status": 200,
      "bytes": 19820,
      "referrer": "....",
      "agent": "...",
      "@log_name": "apache.access"
    },
    "fields": {
      "@timestamp": [
        "2019-12-02T11:00:30.000Z"
      ]
    }
  }
  </code></pre>
  
  <p>Why do the <code>@timestamp</code>s differ regarding their format?</p>
  
  <pre><code>2019-12-02T11:00:30+0000 (UTC timezone, no milliseconds)
  2019-12-02T11:00:30.000Z (milliseconds + "Z" for UTC timezone)
  </code></pre>
  
  <p>What does my index mapping have to look like to have the time quickfilter available in Discover?</p>
  
  <p>Currently it looks like this and it doesn't show me the timespan quickfilter:</p>
  
  <pre><code>...,
  "@timestamp": {
    "type": "date",
    "format": "yyyy-MM-dd'T'HH:mm:ssZ"
  },
  ...
  </code></pre>
  
  <p>Index pattern:</p>
  
  <p><a href="https://i.stack.imgur.com/OZNcW.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/OZNcW.png" alt="enter image description here"></a></p>
  
  <p><a href="https://i.stack.imgur.com/BzxQN.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/BzxQN.png" alt="enter image description here"></a></p>