Kibana Lucene日期范围

Question

我知道这可以作为过滤器完成，但出于'原因'，我需要将其作为Lucene查询执行。

我有一个名为“FileLoadedToElasticDateTime”的字段，我正在尝试查找今年的任何记录，到目前为止，我得到的结果为零。

我试过了：

FileLoadedToElasticDateTime:[2018-01-01 TO 2018-12-31]
FileLoadedToElasticDateTime:[20180101 TO 20181231]
FileLoadedToElasticDateTime:[2018-01-01T00:00:00 TO 2018-12-31T18:00:00] 
FileLoadedToElasticDateTime:[2018-01-01 00:00:00 TO 2018-12-31 18:00:00] <-- Error

以下是该字段的文档视图：

ES映射格式是yyyy-MM-dd hh：mm：ss，我不确定kibana格式是否与我联系？

非常感谢任何帮助。

以下是我尝试使用时间格式的错误

Error: Request to Elasticsearch failed: {"error":{"root_cause":[{"type":"query_shard_exception","reason":"Failed to parse query [FileLoadedToElasticDateTime:[2018-01-01 00:00:00 TO 2018-12-31 18:00:00]]","index_uuid":"HRAubcpVQM2Zk2oUVqN7Ng","index":"analytical"}],"type":"search_phase_execution_exception","reason":"all shards failed","phase":"query","grouped":true,"failed_shards":[{"shard":0,"index":"analytical","node":"Rb3ZRLUYTk-WmEEUOh4tdQ","reason":{"type":"query_shard_exception","reason":"Failed to parse query [FileLoadedToElasticDateTime:[2018-01-01 00:00:00 TO 2018-12-31 18:00:00]]","index_uuid":"HRAubcpVQM2Zk2oUVqN7Ng","index":"analytical","caused_by":{"type":"parse_exception","reason":"Cannot parse 'FileLoadedToElasticDateTime:[2018-01-01 00:00:00 TO 2018-12-31 18:00:00]': Encountered \" <RANGE_GOOP> \"00:00:00 \"\" at line 1, column 40.\nWas expecting:\n    \"TO\" ...\n    ","caused_by":{"type":"parse_exception","reason":"Encountered \" <RANGE_GOOP> \"00:00:00 \"\" at line 1, column 40.\nWas expecting:\n    \"TO\" ...\n    "}}}}]},"status":400}

我已经尝试用引号括起日期，这也不起作用。

我没有得到其他查询的错误，只有零结果

Answer 1

您需要在日期和时间部分之间放置T符号。

这样的事情：

FileLoadedToElasticDateTime:[2018-01-01T00:00:00 TO 2018-12-31T18:00:00]

有关日期格式的更多信息 - https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-date-format.html