弹性搜索错误地映射日期字段(毫秒而不是秒)

时间:2016-02-15 10:46:27

标签: elasticsearch date-formatting

我的映射定义如下:

PUT test1
{
  "settings": {
    "index.mapping.ignore_malformed":true

  },
  "mappings": {
    "supersonic": {
      "dynamic": "true",
      "properties": {
        "date": {
          "type": "date",
          "format": "epoch_second"
        },
        "timestamp": {
          "type": "date",
          "format": "epoch_second"
        },
        "other_date": {
          "type": "date",
          "format": "epoch_millis"
        }
      }
    }
  }
}

现在," other_date"被索引并显示完美。问题是," date"和"时间戳"也被视为毫秒,因此在1970年1月给我日期。日期本身在JSON内到达。我在这里错过了什么吗?

编辑:我正在使用2.1.1。返回的映射是(在第一个事件到达之后):

{
  "test": {
    "mappings": {
      "supersonic": {
        "dynamic": "true",
        "properties": {
          "biomass_cost": {
            "type": "double"
          },
          "date": {
            "type": "date",
            "format": "epoch_second"
          },
          "entity_elements": {
            "type": "string"
          },
          "entity_type": {
            "type": "double"
          },
          "eventId": {
            "type": "double"
          },
          "gameId": {
            "type": "double"
          },
          "instanceId": {
            "type": "double"
          },
          "ipLong": {
            "type": "double"
          },
          "ipLongForwarded": {
            "type": "double"
          },
          "ipLongPeer": {
            "type": "double"
          },
          "networkId": {
            "type": "double"
          },
          "platform_id": {
            "type": "double"
          },
          "playerId": {
            "type": "string"
          },
          "production_id": {
            "type": "string"
          },
          "production_type": {
            "type": "double"
          },
          "queue_size": {
            "type": "double"
          },
          "timestamp": {
            "type": "date",
            "format": "epoch_second"
          },
          "trevor_date": {
            "type": "date",
            "format": "epoch_millis"
          },
          "tsEventAccepted": {
            "type": "double"
          },
          "version": {
            "type": "string"
          }
    }
    }
    }
    }
    }

JSON将是:

发送:{" ipLongPeer":2130706433," biomass_cost":110," NETWORKID":0," ipLong":3561950994, "游戏ID":30,"实例Id":0," tsEventAccepted":1450714430," trevor_date":1450714430731," ipLongForwarded&# 34;:3561950994,"日期":1450714430," production_type":3," entity_elements":" GA_1_0_0_2_0""版本& #34;:" 0.10.46""时间戳":1450714429,"平台_id": - 1," EVENTID":945,& #34; playerId":" mzaman""的queue_size":1," ENTITY_TYPE":1100," production_id":&# 34; 2015.12.21.17.13.45.8556370.3696111"}

1 个答案:

答案 0 :(得分:0)

映射是正确的,使用Elasticsearch 2.2版本可以正常使用。

一些建议:

  • {2.0}中添加了date格式epoch_second。确保您的Elasticsearch版本是最新版本。
  • 使用_mapping API确认索引的映射。例如:GET test1/_mapping
  • 仔细检查要编入索引的JSON文档。

修改

要确认您的日期是否正确解析,您可以使用range查询针对日期字段运行手动查询。例如,根据您的示例文档(日期值为1450714430,转换为2012-12-21 16:13:50 UTC),请尝试以下搜索:

GET /test1/supersonic/_search
{
  "query": {
    "range": {
      "date": {
        "gte": "2015-12-20",
        "lte": "2015-12-22"
      }
    }
  }
}

此查询应返回示例文档,以及date属于该范围的任何其他文档。