python - Elasticsearch 日期范围未返回任何命中

Question

我非常有信心我犯了某种错误，这可能与我映射和/或存储日期字段的方式有关，但我似乎无法弄清楚出了什么问题。我希望这里有人能给我一些指导。

我编写了一个简单的测试应用程序来向您展示我的问题:

from datetime import datetime
from elasticsearch import Elasticsearch

INDEX_NAME = "datetime-test"

ESCONN = Elasticsearch()
ESCONN.indices.create(index=INDEX_NAME, ignore=400)

obj_mapping = {
    'properties': {
        'timestamp': { 'type': 'date' },
    }
}

ESCONN.indices.put_mapping("TestObject", obj_mapping, [INDEX_NAME])

for i in range(0, 5):
    ESCONN.index(index=INDEX_NAME, doc_type="TestObject", body={
        'timestamp': datetime.now(),
    })

    print "Stored %d" % i

我正在尝试存储一个带有字段(称为timestamp)的文档，其中包含datetime.now() 的值。之后，我想请求这个timestamp的值在一定范围内的所有文档:

curl -XPOST "http://localhost:9200/datetime-test/try/_search" -d'
{
 "query": {
    "range": {
      "timestamp": {
         "gt" : "now-1h"
      }
    }
  }
}'

搜索查询返回空。

{
  "took" : 2,
  "timed_out" : false,
  "_shards" : {
    "total" : 5,
    "successful" : 5,
    "failed" : 0
  },
  "hits" : {
    "total" : 0,
    "max_score" : null,
    "hits" : [ ]
  }
}

有谁知道为什么搜索返回空以及我应该做什么来确保 Elasticsearch 正确解释我的 timestamp 字段，以便我的文档显示在正在搜索的查询中日期时间范围？

我正在使用以下版本: - Elasticsearch :1.4.4 -elasticsearch-py:1.4.0

值得注意的是，elasticsearch.yml 目前为空。

[编辑]

curl -XGET 'http://localhost:9200/datetime-test/_mapping/TestObject?pretty'
{
  "datetime-test" : {
    "mappings" : {
      "TestObject" : {
        "properties" : {
          "timestamp" : {
            "type" : "date",
            "format" : "dateOptionalTime"
          }
        }
      }
    }
  }
}

[/编辑]

Answer 1

这似乎是 UTC 与本地时间的问题。

当我运行你的代码并尝试这个时，我得到了结果:

POST /test_index/_search
{
   "query": {
      "range": {
         "timestamp": {
            "gt": "now-12h"
         }
      }
   }
}

另一方面，当我将 'timestamp': datetime.now(), 更改为 'timestamp': datetime.utcnow(), 时，您的查询有效。

为了完整起见，这是我使用的完整示例:

Python 代码:

from datetime import datetime
from elasticsearch import Elasticsearch

INDEX_NAME = "test_index"

ESCONN = Elasticsearch()

if ESCONN.indices.exists(INDEX_NAME):
    ESCONN.indices.delete(index = INDEX_NAME, ignore=[400, 404])

ESCONN.indices.create(index=INDEX_NAME, ignore=400)

obj_mapping = {
    'properties': {
        'timestamp': { 'type': 'date' },
    }
}

ESCONN.indices.put_mapping("doc", obj_mapping, [INDEX_NAME])

for i in range(0, 5):
    ESCONN.index(index=INDEX_NAME, doc_type="doc", body={
        'timestamp': datetime.utcnow(),
    })

    print "Stored %d" % i

感应代码:

POST /test_index/_search
{
   "query": {
      "range": {
         "timestamp": {
            "gt": "now-1h"
         }
      }
   }
}
...
{
   "took": 3,
   "timed_out": false,
   "_shards": {
      "total": 5,
      "successful": 5,
      "failed": 0
   },
   "hits": {
      "total": 5,
      "max_score": 1,
      "hits": [
         {
            "_index": "test_index",
            "_type": "doc",
            "_id": "_AaKzzXLQuiLyBAjT9YDqA",
            "_score": 1,
            "_source": {
               "timestamp": "2015-03-07T19:35:51.914612"
            }
         },
         {
            "_index": "test_index",
            "_type": "doc",
            "_id": "rCSziknqTKWXfoY7hRJiIw",
            "_score": 1,
            "_source": {
               "timestamp": "2015-03-07T19:35:51.919175"
            }
         },
         {
            "_index": "test_index",
            "_type": "doc",
            "_id": "5yXtPWGATwe4n3kAVbwRfg",
            "_score": 1,
            "_source": {
               "timestamp": "2015-03-07T19:35:51.909425"
            }
         },
         {
            "_index": "test_index",
            "_type": "doc",
            "_id": "fwNb4iVVQFmPi9jo8PZxhA",
            "_score": 1,
            "_source": {
               "timestamp": "2015-03-07T19:35:51.912478"
            }
         },
         {
            "_index": "test_index",
            "_type": "doc",
            "_id": "PGHXxzvKRrakvJWMRtVQXQ",
            "_score": 1,
            "_source": {
               "timestamp": "2015-03-07T19:35:51.916854"
            }
         }
      ]
   }
}