Question

我正在尝试建立一个新索引，但我在Kibana遇到了一些问题。 “发现”页面显示“正在搜索...”＃34;现在几个小时，只有少数几个数据点。我认为格式化可能存在问题？

索引页面显示Average，Maximum和Minimum都是数字，analyze = false，indexed = true。 InstanceID，MetricName，Region都是字符串，已分析并已索引= True。时间戳是一个日期

这是否表明问题可能是什么？

修改警告的附加信息：＆＃34;此字段未启用Doc值。这可能导致在可视化时出现过多的堆消耗。 ...和... ＆＃34;这是一个分析的字符串字段。分析字符串非常独特，可以使用大量内存来分析＆＃34;

编辑2： 几点说明：我的映射似乎没有正常工作。

Invoke-RestMethod "$URI/mytestindex/t2credbal" -Method post -body '{
  "mytestindex": {
   "mappings": {
     "t2credbal": { 
       "properties": {
        "timestamp": {"type":"date"},
        "minimum": {"type":"number", "index":"no", "fielddata": { "format": "doc_values" } },
        "maximum": {"type":"number", "index":"no", "fielddata": { "format": "doc_values" } },
        "average": {"type":"number", "index":"no", "fielddata": { "format": "doc_values" } }   
          }  } } } }'

当我运行上面的命令时，我的字段显示为mytestindex.mappings.t2credbal.properties.timestamp，而不仅仅是时间戳

我的值报告为Records.Timestamp（根据下面的命令），具有正确的字段类型，所以我不认为在我的情况下指定映射是完全必要的。但是，Kibana无法搜索和分析数据，尽管它完全按照我的预期在ElasticSearch中列出。

$json= {Records:  [
   {
    "Minimum":  280.91,
    "Maximum":  280.97,
    "Average":  280.94416666666672,
    "Timestamp":  "2015-04-27T13:12:00Z",
    "InstanceID":  "i-65e2b951",
    "MetricName":  "CPUCreditBalance",
    "Region":  "eu-west-1"
   }

Invoke-RestMethod "$URI/mytestindex/t2credbal/" -Method Post -Body $json -ContentType 'application/json'

编辑＃3

我将时间戳格式调整为在我的其他索引中为我工作的格式;但是，在尝试可视化时间戳字段时，我收到以下错误：

Error: Request to Elasticsearch failed: {"error":"SearchPhaseExecutionException[Failed to execute phase [query], all shards failed; shardFailures {[S73SynuOQzW4NKbwPN7tTg][mytestindex][0]: SearchParseException[[mytestindex][0]: 
query[ConstantScore(*:*)],from[-1],size[0]: Parse Failure [Failed to parse source [{\"size\":0,\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\"}},\"aggs\":{\"1\":{\"date_histogram\":{\"field\":\"Records.Timestamp\",\"interval\":\"0ms\",\"pre_zone\":\"-04:00\",\"pre_zone_adjust_large_interval\":true,\"min_doc_count\":1,\"extended_bounds\":{\"min\":1430158024806,\"max\":1430158924806}}}}}]]]; nested: 
ElasticsearchIllegalArgumentException[Zero or negative time interval not supported]; }{[S73SynuOQzW4NKbwPN7tTg][mytestindex][1]: SearchParseException[[mytestindex][1]: query[ConstantScore(*:*)],from[-1],size[0]: Parse Failure [Failed to parse source [{\"size\":0,\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\"}},\"aggs\":{\"1\":{\"date_histogram\":{\"field\":\"Records.Timestamp\",\"interval\":\"0ms\",\"pre_zone\":\"-04:00\",\"pre_zone_adjust_large_interval\":true,\"min_doc_count\":1,\"extended_bounds\":{\"min\":1430158024806,\"max\":1430158924806}}}}}]]]; nested:
 ElasticsearchIllegalArgumentException[Zero or negative time interval not supported]; }{[S73SynuOQzW4NKbwPN7tTg][mytestindex][2]: SearchParseException[[mytestindex][2]: query[ConstantScore(*:*)],from[-1],size[0]: Parse Failure [Failed to parse source [{\"size\":0,\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\"}},\"aggs\":{\"1\":{\"date_histogram\":{\"field\":\"Records.Timestamp\",\"interval\":\"0ms\",\"pre_zone\":\"-04:00\",\"pre_zone_adjust_large_interval\":true,\"min_doc_count\":1,\"extended_bounds\":{\"min\":1430158024806,\"max\":1430158924806}}}}}]]]; nested: 
ElasticsearchIllegalArgumentException[Zero or negative time interval not supported]; }{[S73SynuOQzW4NKbwPN7tTg][mytestindex][3]: SearchParseException[[mytestindex][3]: query[ConstantScore(*:*)],from[-1],size[0]: Parse Failure [Failed to parse source [{\"size\":0,\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\"}},\"aggs\":{\"1\":{\"date_histogram\":{\"field\":\"Records.Timestamp\",\"interval\":\"0ms\",\"pre_zone\":\"-04:00\",\"pre_zone_adjust_large_interval\":true,\"min_doc_count\":1,\"extended_bounds\":{\"min\":1430158024806,\"max\":1430158924806}}}}}]]]; nested: 
ElasticsearchIllegalArgumentException[Zero or negative time interval not supported]; }{[S73SynuOQzW4NKbwPN7tTg][mytestindex][4]: SearchParseException[[mytestindex][4]: query[ConstantScore(*:*)],from[-1],size[0]: Parse Failure [Failed to parse source [{\"size\":0,\"query\":{\"query_string\":{\"analyze_wildcard\":true,\"query\":\"*\"}},\"aggs\":{\"1\":{\"date_histogram\":{\"field\":\"Records.Timestamp\",\"interval\":\"0ms\",\"pre_zone\":\"-04:00\",\"pre_zone_adjust_large_interval\":true,\"min_doc_count\":1,\"extended_bounds\":{\"min\":1430158024806,\"max\":1430158924806}}}}}]]]; nested: 
 ElasticsearchIllegalArgumentException[Zero or negative time interval not supported]; }]"}
at http://myurl.com/index.js?_b=5930:42978:38
at Function.Promise.try (http://myurl.com/index.js?_b=5930:46205:26)
at http://myurl.com/index.js?_b=5930:46183:27
at Array.map (native)
at Function.Promise.map (http://myurl.com/index.js?_b=5930:46182:30)
at callResponseHandlers (http://myurl.com/index.js?_b=5930:42950:22)
at http://myurl.com/index.js?_b=5930:43068:16
at wrappedCallback (http://myurl.com/index.js?_b=5930:20873:81)
at wrappedCallback (http://myurl.com/index.js?_b=5930:20873:81)
at http://myurl.com/index.js?_b=5930:20959:26

编辑＃4

修正了时间戳格式。验证结果是否使用_search显示为预期？句法。完全吹灭并重新创建我的索引，验证所有字段名称和类型都是正确的。 Discover屏幕现在显示＆＃34;没有结果＆＃34;而不是＆＃34;搜索...＆＃34;。当我将时间间隔从15分钟更改为任何其他值时，我得到以下内容：

Discover: Cannot read property 'indexOf' of undefined
TypeError: Cannot read property 'indexOf' of undefined
at Notifier.error (myurl/index.js?_b=5930:45607:23)
at Notifier.bound (myurl/index.js?_b=5930:32081:21)
at myurl/index.js?_b=5930:118772:18
at wrappedCallback (myurl/index.js?_b=5930:20873:81)
at myurl/index.js?_b=5930:20959:26
at Scope.$eval (myurl/index.js?_b=5930:22002:28)
at Scope.$digest (myurl/index.js?_b=5930:21814:31)
at Scope.$apply (myurl/index.js?_b=5930:22106:24)
at done (myurl/index.js?_b=5930:17641:45)
at completeRequest (myurl/index.js?_b=5930:17855:7)

Answer 1

我能够通过更正ElasticSearch中的日期格式来解决此问题。我的脚本中的Powershell convertto-json命令将时间戳对象转换为与Kibana不配合的日期格式。在将日期格式设置为yyyy-MM-hhThh：mm：ss后，永无止境的“搜索...”问题消失了，但出现了新的问题。

将单独发布该问题。

Kibana显示＆＃34;搜索...＆＃34;，不显示任何结果。 ElasticSearch中存在已确认的数据

1 个答案: