Elasticsearch：查询无法返回正确的结果

Question

我在elasticsearch中编写了以下查询，用于求和len_err的列值，其中app_name为9，并且在查询中指定了时间戳。

GET features-1/_search
{
  "query": {
    "match": {
      "app_name": 9
    }
  }, 
  "post_filter": {
    "range": {
      "timestamp": {
        "gte": "2018-07-21T09:14:12Z",
        "lte": "2018-07-21T09:14:20Z"
      }
    }
  }, 
"aggs": {
  "time_filter":{
    "filter": {
      "range": {
        "timestamp": {
          "gte": "2018-07-21T09:14:12Z",
          "lte": "2018-07-21T09:14:20Z"
        }
      }
    },
    "aggs": {
      "cont_err": {
        "sum": {
          "field": "len_err"
        }
      }
    }

  }


}
}

但是我得到的结果是

{
  "took": 36,
  "timed_out": false,
  "_shards": {
    "total": 1,
    "successful": 1,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 0,
    "max_score": null,
    "hits": []
  },
  "aggregations": {
    "time_filter": {
      "doc_count": 0,
      "cont_err": {
        "value": 0
      }
    }
  }
}

但是当我检查日志时，我发现我有此过滤条件的日志

一个应匹配的示例文档

在下面映射

{
  "features-1": {
    "mappings": {
      "log": {
        "properties": {
          "app_name": {
            "type": "long"
          },
          "len_err": {
            "type": "long"
          },
          "len_msg": {
            "type": "long"
          },
          "severity": {
            "type": "long"
          },
          "source": {
            "properties": {
              "docker": {
                "properties": {
                  "container_id": {
                    "type": "text",
                    "fields": {
                      "keyword": {
                        "type": "keyword",
                        "ignore_above": 256
                      }
                    }
                  }
                }
              },
              "edge_id": {
                "type": "long"
              },
              "kubernetes": {
                "properties": {
                  "container_name": {
                    "type": "long"
                  },
                  "host": {
                    "type": "text",
                    "fields": {
                      "keyword": {
                        "type": "keyword",
                        "ignore_above": 256
                      }
                    }
                  }
                }
              },
              "level": {
                "type": "long"
              },
              "log": {
                "type": "text",
                "fields": {
                  "keyword": {
                    "type": "keyword",
                    "ignore_above": 256
                  }
                }
              },
              "log_field": {
                "properties": {
                  "LogLevel": {
                    "type": "long"
                  },
                  "charging": {
                    "type": "long"
                  }
                }
              }
            }
          },
          "timestamp": {
            "type": "date"
          }
        }
      }
    }
  }
}