elasticsearch - 如何以时间戳获取 Elasticsearch 查询结果时间

Question

当我对 Elasticsearch（通过 Kibana 开发工具）进行查询时，如下所示

GET _search
{
  "query": {
    "match": {
      "node_id": "Abc"
    }
  }
}

我得到下面结果的样本。结果有一个格式的ts键date，而不是时间戳格式。如何编写查询以使该ts字段处于时间戳中？有没有办法指定格式？

"_source" : {
          "organization_eid" : "Ga2",
          "node_id" : "Abc",
          "ts" : "2021-02-27T00:18:39.75226593Z
}

更新：

我在docvalue_fields上面_source的查询中添加了。我的整个查询如下：

GET _search
{
  "version": true,
  "size": 500,
  "sort": [
    {
      "ts": {
        "order": "desc",
        "unmapped_type": "boolean"
      }
    }
  ],
  "docvalue_fields": [
    {
      "field": "ts",
      "format": "epoch_millis"
    }
  ],
  "_source": {
    "excludes": []
  },
  "aggs": {
    "2": {
      "date_histogram": {
        "field": "ts",
        "fixed_interval": "10m",
        "time_zone": "America/Los_Angeles",
        "min_doc_count": 1
      }
    }
  },
  "stored_fields": [
    "*"
  ],
  "script_fields": {},
  "query": {
    "bool": {
      "must": [],
      "filter": [
        {
          "match_all": {}
        },
        {
          "range": {
            "ts": {
              "format": "strict_date_optional_time",
              "gte": "2021-03-03T00:30:00.000Z",
              "lte": "2021-03-03T12:00:00.000Z"
            }
          }
        }
      ],
      "should": [],
      "must_not": []
    }
  },
  "highlight": {
    "pre_tags": [
      "@kibana-highlighted-field@"
    ],
    "post_tags": [
      "@/kibana-highlighted-field@"
    ],
    "fields": {
      "*": {}
    },
    "fragment_size": 2147483647
  }
}

现在在输出中，我看到下面（仅显示hits部分）

"hits" : [
      {
        "_index" : "url.0.2_6_18689",
        "_type" : "_doc",
        "_id" : "...",
        "_version" : 1,
        "_score" : null,
        "_source" : {
          "organization_eid" : "Ga2",
          "node_id" : "Abc",
          "ts" : "2021-03-03T11:59:30.705142021Z",
          "destination" : "....",
        "fields" : {
          "ts" : [
            "1614772770705"
          ]

如上所示，里面fields的ts被转换为timestamp但里面_source的ts仍然是datetime。

我错过了什么？

标签： elasticsearchkibana

Answer 1

您可以做的是利用doc values 字段来检索原始时间戳值：

GET _search
{
  "docvalue_fields": [ "ts" ],                    <---- add this
  "_source": ["organization_eid", "node_id"],
  "query": {
    "match": {
      "node_id": "Abc"
    }
  }
}