Query validation shows a false type warning for quoted values on Graylog-managed timestamp fields #27703

Description

A valid query on a Graylog-managed timestamp field produces a validation warning, although the search itself returns correct results.

timestamp:"2026-10-06 07:36:15.116"

Warning:

Invalid value type: Type of timestamp is date, cannot use value 07:36:15.116

Affected fields are the date fields Graylog maps with the format uuuu-MM-dd HH:mm:ss.SSS, which requires a space between date and time:

• Message indices: timestamp, gl2_receive_timestamp, gl2_original_timestamp, gl2_processing_timestamp
• Event indices: timestamp, timestamp_processing, timerange_start, timerange_end

Dynamically mapped date fields are not affected, because their ISO 8601 format (2026-10-06T07:36:15.116Z) contains no whitespace.

Cause

The query validator parses the query with a WhitespaceAnalyzer (LuceneQueryParser.java). A quoted value is split into separate terms (2026-10-06 and 07:36:15.116), and FieldTypeValidationImpl checks each term against the field type on its own. 07:36:15.116 is not a date, so a warning is shown. The full value 2026-10-06 07:36:15.116 would pass the date check.

Steps to reproduce

1. Open a search.
2. Enter timestamp:"2026-10-06 07:36:15.116" (any valid timestamp).