Question

我很自信我犯了某种错误，这可能与我映射和/或存储我的日期字段的方式有关，但我似乎无法弄清楚出了什么问题。我希望有人能给我一些指导。

我写了一个简单的测试应用程序来向你展示我的问题：

from datetime import datetime
from elasticsearch import Elasticsearch

INDEX_NAME = "datetime-test"

ESCONN = Elasticsearch()
ESCONN.indices.create(index=INDEX_NAME, ignore=400)

obj_mapping = {
    'properties': {
        'timestamp': { 'type': 'date' },
    }
}

ESCONN.indices.put_mapping("TestObject", obj_mapping, [INDEX_NAME])

for i in range(0, 5):
    ESCONN.index(index=INDEX_NAME, doc_type="TestObject", body={
        'timestamp': datetime.now(),
    })

    print "Stored %d" % i

我正在尝试使用包含值timestamp的字段（名为datetime.now()）来存储文档。之后，我想请求此timestamp的值在一定范围内的所有文档：

curl -XPOST "http://localhost:9200/datetime-test/try/_search" -d'
{
 "query": {
    "range": {
      "timestamp": {
         "gt" : "now-1h"
      }
    }
  }
}'

搜索查询返回空白。

{
  "took" : 2,
  "timed_out" : false,
  "_shards" : {
    "total" : 5,
    "successful" : 5,
    "failed" : 0
  },
  "hits" : {
    "total" : 0,
    "max_score" : null,
    "hits" : [ ]
  }
}

有没有人知道为什么搜索会变回空白，我应该怎么做以确保Elasticsearch正确解释我的timestamp字段，以便我的文档显示在搜索日期时间的查询中范围？

我使用以下版本： - Elasticsearch：1.4.4 - elasticsearch-py：1.4.0

值得注意的是elasticsearch.yml目前是空的。

[编辑]

curl -XGET 'http://localhost:9200/datetime-test/_mapping/TestObject?pretty'
{
  "datetime-test" : {
    "mappings" : {
      "TestObject" : {
        "properties" : {
          "timestamp" : {
            "type" : "date",
            "format" : "dateOptionalTime"
          }
        }
      }
    }
  }
}

[/编辑]

Answer 1

似乎是UTC与当地时间问题。

当我运行你的代码并尝试过这个时，我得到了结果：

POST /test_index/_search
{
   "query": {
      "range": {
         "timestamp": {
            "gt": "now-12h"
         }
      }
   }
}

另一方面，当我将'timestamp': datetime.now(),更改为'timestamp': datetime.utcnow(),时，您的查询有效。

为了完整起见，这是我使用的完整示例：

Python代码：

from datetime import datetime
from elasticsearch import Elasticsearch

INDEX_NAME = "test_index"

ESCONN = Elasticsearch()

if ESCONN.indices.exists(INDEX_NAME):
    ESCONN.indices.delete(index = INDEX_NAME, ignore=[400, 404])

ESCONN.indices.create(index=INDEX_NAME, ignore=400)

obj_mapping = {
    'properties': {
        'timestamp': { 'type': 'date' },
    }
}

ESCONN.indices.put_mapping("doc", obj_mapping, [INDEX_NAME])

for i in range(0, 5):
    ESCONN.index(index=INDEX_NAME, doc_type="doc", body={
        'timestamp': datetime.utcnow(),
    })

    print "Stored %d" % i

感觉代码：

POST /test_index/_search
{
   "query": {
      "range": {
         "timestamp": {
            "gt": "now-1h"
         }
      }
   }
}
...
{
   "took": 3,
   "timed_out": false,
   "_shards": {
      "total": 5,
      "successful": 5,
      "failed": 0
   },
   "hits": {
      "total": 5,
      "max_score": 1,
      "hits": [
         {
            "_index": "test_index",
            "_type": "doc",
            "_id": "_AaKzzXLQuiLyBAjT9YDqA",
            "_score": 1,
            "_source": {
               "timestamp": "2015-03-07T19:35:51.914612"
            }
         },
         {
            "_index": "test_index",
            "_type": "doc",
            "_id": "rCSziknqTKWXfoY7hRJiIw",
            "_score": 1,
            "_source": {
               "timestamp": "2015-03-07T19:35:51.919175"
            }
         },
         {
            "_index": "test_index",
            "_type": "doc",
            "_id": "5yXtPWGATwe4n3kAVbwRfg",
            "_score": 1,
            "_source": {
               "timestamp": "2015-03-07T19:35:51.909425"
            }
         },
         {
            "_index": "test_index",
            "_type": "doc",
            "_id": "fwNb4iVVQFmPi9jo8PZxhA",
            "_score": 1,
            "_source": {
               "timestamp": "2015-03-07T19:35:51.912478"
            }
         },
         {
            "_index": "test_index",
            "_type": "doc",
            "_id": "PGHXxzvKRrakvJWMRtVQXQ",
            "_score": 1,
            "_source": {
               "timestamp": "2015-03-07T19:35:51.916854"
            }
         }
      ]
   }
}

Elasticsearch日期范围不返回任何匹配

1 个答案: