Question

ES版本2.2.1

下面是我为testindex创建的Mapping

    "event_time_utc": {
      "index": "not_analyzed",
      "format": "YYYY-MM-dd HH:mm:ss",
      "type": "date"

下面是我用来将文档插入testindex

的Curl命令

curl -k -XPOST http://10.1.69.191:8080/testindex/logs -d '{

"Username": "user@mailbox.com",
"Application": "App Dev",
"Platform": "Unknown",
"Browser": "Unknown",
"Status": "Success",
"SourceIP": "1.1.1.1",
"event_time_utc" : "2016-12-08 23:44:40",
"LoginType": "Remote Access 2.0",
"timestamp": "2016-12-12T19:41:36.214Z"
}'

下面是elasticsearch应用程序生成的错误，它无法解析event_time_utc。并将畸形日期作为理由。但我无法发现这个问题。

{"error":{"root_cause":[{"type":"mapper_parsing_exception","reason":"failed 
to parse [event_time_utc]"}],"type":"mapper_parsing_exception","reason":"failed to parse
 [event_time_utc]","caused_by":{"type":"illegal_argument_exception","reason":
"Invalid format: \"2016-12-08 23:44:40\" is malformed at \" 23:44:40\""}},

Answer 1

映射中的日期模式是错误的，它应该如下所示，即您需要在两个单引号之间编码空格字符。

"mappings": {
  "logs": {                     <--- make sure you have this
    "dynamic": "false",
    "properties": {
      "event_time_utc": {
        "index": "not_analyzed",
        "format": "yyyy-MM-dd' 'HH:mm:ss",
        "type": "date"

另外请确保，因为您发送的卷曲是/testindex/logs，您的地图类型称为logs，而不是loginevent

Answer 2

所以我发现了问题所在。在我的映射文件的开头，我定义了一个自定义类型（非 defualt ）。这就是抛弃我的卷曲命令。我没有添加类型。

我的索引模板中的相关映射配置。

"mappings": {
  "loginevent": {
    "dynamic": "false",
    "properties": {
      "event_time_utc": {
        "index": "not_analyzed",
        "format": "YYYY-MM-dd HH:mm:ss",
        "type": "date"
      }

更新了curl命令

 curl -k -XPOST 'http://10.1.69.191:8080/testindex/loginevent' -d '{

成功执行

{"_index":"testindex","_type":"loginevent","_id":"AVj-UoW23y1afHQdnQA-","_version":1,"_shards":{"total":2,"successful":1,"failed":0},"created":true}

为什么Elasticsearch在使用自定义日期时间戳时拒绝输入格式错误？

2 个答案: