ElasticSearch 无法解析日期字段。

huangapple go评论112阅读模式
英文:

ElasticSearch failed to parse date field

问题

以下是您要求的翻译内容:

我有以下查询,我试图在Kibana Dev Tools中在Elasticsearch 5.6上运行:

  1. {
  2. "query": {
  3. "bool": {
  4. "filter": {
  5. "bool": {
  6. "must": [
  7. {
  8. "range": {
  9. "inserted": {
  10. "gt": "Thu Aug 20 09:01:31 +0100 2020"
  11. }
  12. }
  13. }
  14. ]
  15. }
  16. }
  17. }
  18. }
  19. }

我得到的响应是:

  1. {
  2. "error": {
  3. "root_cause": [
  4. {
  5. "type": "parse_exception",
  6. "reason": "failed to parse date field [Thu Aug 20 09:01:31 +0100 2020] with format [EEE MMM dd HH:mm:ss ZZZ yyyy]"
  7. }
  8. ],
  9. "type": "search_phase_execution_exception",
  10. "reason": "all shards failed",
  11. "phase": "can_match",
  12. "grouped": true
  13. }

对我来说,日期时间格式看起来是正确的,我做错了什么?

英文:

I have the following query that I'm trying to run on Elasticsearch 5.6 in Kibana Dev Tools:

  1. {
  2. "query": {
  3. "bool": {
  4. "filter": {
  5. "bool": {
  6. "must": [
  7. {
  8. "range": {
  9. "inserted": {
  10. "gt": "Thu Aug 20 09:01:31 +0100 2020"
  11. }
  12. }
  13. }
  14. ]
  15. }
  16. }
  17. }
  18. }
  19. }

the response I'm getting is:

  1. {
  2. "error": {
  3. "root_cause": [
  4. {
  5. "type": "parse_exception",
  6. "reason": "failed to parse date field [Thu Aug 20 09:01:31 +0100 2020] with format [EEE MMM dd HH:mm:ss ZZZ yyyy]"
  7. }
  8. ],
  9. "type": "search_phase_execution_exception",
  10. "reason": "all shards failed",
  11. "phase": "can_match",
  12. "grouped": true,

The datetime format looks correct to me, what am I doing wrong?

答案1

得分: 3

简而言之: 'EEE MMM dd HH:mm:ss Z yyyy' 是正确的日期时间格式。

细节:

  1. Elastic Search 使用 Joda 库来格式化日期时间。

来自 ES 文档 的摘录:

完全可定制的日期格式受支持。其语法在 Joda 文档中有解释。

  1. 尝试使用 Joda 库中你正在使用的模式 "EEE MMM dd HH:mm:ss ZZZ yyyy" 格式化日期时间。编程语言为 Java
  1. DateTimeFormatter formatter = DateTimeFormat.forPattern("EEE MMM dd HH:mm:ss ZZZ yyyy");
  2. DateTime dateTime = formatter.parseDateTime("Thu Aug 20 09:01:31 +0100 2020");

结果会导致以下异常:

  1. Exception in thread "main" java.lang.IllegalArgumentException: Invalid format: "Thu Aug 20 09:01:31 +0100 2020" is malformed at "+0100 2020"
  2. at org.joda.time.format.DateTimeFormatter.parseDateTime(DateTimeFormatter.java:866)

推论: 与 'ZZZ' 所定义的格式有些问题。

来自 JodaDoc

Z 时区偏移/标识 区域 -0800

  1. 根据调查,正确的格式是 "EEE MMM dd HH:mm:ss Z yyyy" 而不是 "EEE MMM dd HH:mm:ss ZZZ yyyy"。

  2. 考虑到第三点,在您的映射中定义格式,如下所示:

  1. {
  2. "mappings": {
  3. "_doc": {
  4. "properties": {
  5. "inserted": {
  6. "type": "date",
  7. "format": "EEE MMM dd HH:mm:ss Z yyyy"
  8. }
  9. }
  10. }
  11. }
  12. }
英文:

In Short: 'EEE MMM dd HH:mm:ss Z yyyy' is the correct format.

Details:

  1. Elastic Search uses Joda library for formatting DateTime.

Excerpt from ES Docs
> Completely customizable date formats are supported. The syntax for these is explained in the Joda docs.

  1. Try formatting DateTime with the pattern you are using "EEE MMM dd HH:mm:ss ZZZ yyyy" using Joda library. Programming language is Java

> DateTimeFormatter formatter = DateTimeFormat.forPattern("EEE MMM dd HH:mm:ss ZZZ yyyy");
> DateTime dateTime = formatter.parseDateTime("Thu Aug 20 09:01:31 +0100 2020");

It is resulting in below exception :

> Exception in thread "main" java.lang.IllegalArgumentException: Invalid
> format: "Thu Aug 20 09:01:31 +0100 2020" is malformed at "+0100 2020"
> at
> org.joda.time.format.DateTimeFormatter.parseDateTime(DateTimeFormatter.java:866)

Deduction: There is something wrong with the format defined by 'ZZZ'

From JodaDoc
> Z time zone offset/id zone -0800

  1. Based on the investigation correct format is "EEE MMM dd HH:mm:ss Z yyyy" and not "EEE MMM dd HH:mm:ss ZZZ yyyy".

  2. Considering #3 define format in your mapping like

> {
> "mappings": {
> "_doc":{
> "properties": {
> "inserted":{
> "type": "date",
> "format": "EEE MMM dd HH:mm:ss Z yyyy"
> }
> }
> }
> }
> }

huangapple
  • 本文由 发表于 2020年8月22日 21:05:24
  • 转载请务必保留本文链接:https://go.coder-hub.com/63536502.html
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定