弹性搜索无法执行时间戳范围查询

Question

我需要在一定的时间范围内进行查询，

首先，我想做一个查询，比如

    {
  "query": {
    "bool": {
      "must": [
        {
          "query_string": {
            "query": "13000020"
          }
        },
        {
          "range": {
            "timestampstring": {
              "lte": "2020-10-05 15:22:58.537"
            }
          }
        }

      ]
    }
  }
}

结果是

{
    "took": 15,
    "timed_out": false,
    "_shards": {
        "total": 1,
        "successful": 1,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": {
            "value": 12,
            "relation": "eq"
        },
        "max_score": 2.0,
        "hits": [
            {
                "_index": "test",
                "_type": "test12",
                "_id": "WvNJl3UBy18_Kc9Pl1tu",
                "_score": 2.0,
                "_source": {
                    "hdrId": 13000020,
                    "timestampstring": "2020-11-05 15:22:58.537",
                    "DevieId": "624232489",
                    "type": "data"
                }
            },
            {
                "_index": "test",
                "_type": "test12",
                "_id": "jvOSmHUBy18_Kc9PK3qp",
                "_score": 2.0,
                "_source": {
                    "hdrId": 13000020,
                    "timestamp": 1604582511655,
                    "timestampstring": "2020-11-05 21:21:51.655",
                    "type": "data"
                }
            }
        ]
    }
}

有人能指出我做错了什么吗？

第二，我没有做这个例子https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-daterange-aggregation.html

上面的例子如何适合我的应用，谢谢

杰夫

此时此刻，我正试图在《邮递员》中进行设置

GET超文本传输协议：//myip： 9200/test/dev/_search我需要在这里做索引吗？

{
  "mappings": {
    "properties": {
      "timestampstring": {
        "type": "date",
        "format": "yyyy-MM-dd HH:mm:ss.SSS"
      }
    }
  }
}

它来了

{
    "error": {
        "root_cause": [
            {
                "type": "parsing_exception",
                "reason": "Unknown key for a START_OBJECT in [mappings].",
                "line": 2,
                "col": 15
            }
        ],
        "type": "parsing_exception",
        "reason": "Unknown key for a START_OBJECT in [mappings].",
        "line": 2,
        "col": 15
    },
    "status": 400
}

Answer 1

您可能没有为timestamstring设置索引映射。要了解有关日期格式的更多信息，请参阅

添加包含索引数据、映射、搜索查询和搜索结果的工作示例

索引映射：

{
  "mappings": {
    "properties": {
      "timestampstring": {
        "type": "date",
        "format": "yyyy-MM-dd HH:mm:ss.SSS"
      }
    }
  }
}

指数数据：

{
  "hdrId": 13000020,
  "timestamp": 1604582511655,
  "timestampstring": "2020-11-05 21:21:51.655",
  "type": "data"
}
{
  "hdrId": 13000020,
  "timestampstring": "2020-11-05 15:22:58.537",
  "DevieId": "624232489",
  "type": "data"
}

搜索查询：

现在运行相同的搜索查询，您将获得所需的结果

{
  "query": {
    "bool": {
      "must": [
        {
          "query_string": {
            "query": "13000020"
          }
        },
        {
          "range": {
            "timestampstring": {
              "lte": "2020-10-05 15:22:58.537"
            }
          }
        }
      ]
    }
  }
}

搜索结果：

"hits": []

可以通过以下方式应用日期范围聚合：

{
  "aggs": {
    "range": {
      "date_range": {
        "field": "timestampstring",
        "format": "yyyy-MM-dd HH:mm:ss.SSS",
        "ranges": [
          {
            "to": "now-1M"       
          },
          {
            "from": "now-1M"
          }
        ]
      }
    }
  }
}

上述查询将创建两个范围桶，第一个将“桶”所有日期在1个月前之前的文档，第二个将“桶”所有日期在1个月前之前的文档。由于在索引数据中，没有日期在1个月之前的文档，因此第一个桶的doc_count为0，第二个桶的为2

搜索结果：

"aggregations": {
    "range": {
      "buckets": [
        {
          "key": "*-2020-10-25 10:10:07.665",
          "to": 1.603620607665E12,
          "to_as_string": "2020-10-25 10:10:07.665",
          "doc_count": 0
        },
        {
          "key": "2020-10-25 10:10:07.665-*",
          "from": 1.603620607665E12,
          "from_as_string": "2020-10-25 10:10:07.665",
          "doc_count": 2
        }
      ]
    }
  }