如何从 DynamoDB for Elasticsearch/Kibana 格式化时间戳？

Question

I'm pushing DynamoDB rows into a Elasticsearch cluster. The date fields are unix timestamps and not recognized by Kibana as a date.

I read about Elasticsearch mapping types and found this post , but don't know where to implement the mapping in my Lambda script:

/* ... requires and config ... */

exports.handler = (event, context, callback) => {        
    event.Records.forEach((record) => {
        var dbRecord = JSON.stringify(record.dynamodb);
        postToES(dbRecord, context, callback);
    });
};

function postToES(doc, context, lambdaCallback) {
    var req = new AWS.HttpRequest(endpoint);

    req.method = 'POST';
    req.path = path.join('/', esDomain.index, esDomain.doctype);
    req.region = esDomain.region;
    req.headers['presigned-expires'] = false;
    req.headers['Host'] = endpoint.host;
    req.body = doc; 

    // Maybe here?

    var signer = new AWS.Signers.V4(req , 'es');  
    signer.addAuthorization(creds, new Date());

    var send = new AWS.NodeHttpClient();
    send.handleRequest(req, null, function(httpResp) {
        var respBody = '';
        httpResp.on('data', function (chunk) {
            respBody += chunk;
        });
        httpResp.on('end', function (chunk) {
            lambdaCallback(null,'Lambda added document ' + doc);
        });
    }, function(err) {
        console.log('Error: ' + err);
        lambdaCallback('Lambda failed with error ' + err);
    });
}

Elasticsearch document

{
    _index: "posts",
    _type: "post",
    _id: "6YKF2AAV06RSSRrzv6R-",
    _version: 1,
    found: true,
    _source: {
        ApproximateCreationDateTime: 1499922960,
        Keys: {
            id: {
                S: "7asda8b0-628a-11e7-9e5e-25xyc7179dx7"
            }
        },
        NewImage: {
            posted_at: {
                N: "1499922995401"
            },
            id: {
                S: "7asda8b0-628a-11e7-9e5e-25xyc7179dx7"
            }
        },
        SequenceNumber: "2442423900000000003279639454",
        SizeBytes: 221,
        StreamViewType: "NEW_AND_OLD_IMAGES"
    }
}

Dynamoose Schema

var Schema = dynamoose.Schema;
var s = new Schema({
    id: {
        type: String,
        hashKey: true,
        required: true
    },
    posted_at: {
        type: Date,
        required: true
    }
});

module.exports = dynamoose.model('posts', s);

Example: in my DynamoDB table I've the field posted_at . The content is a unix timestamp. In Kiabana it's indexed as

• NewImage.posted_at.N (type: string, searchable, analyzed) and
• NewImage.posted_at.N.keyword (type: string, searchable, aggregateable)

I'm confused by the N and type: string .

Any ideas? Thanks!

Answer 1

Ok it turns out that the N is there to denote the DynamoDB attribute type (ie N stands for Number ).

The problem is that the number gets stringified and thus indexed as a string in ES (ie what you currently see in your mapping).

We can get around this using a dynamic template definition. First delete your index in ES and the corresponding index pattern in Kibana. Then run this command:

curl -XPUT localhost:9200/_template/post_template -d '{
  "template": "posts",
  "mappings": {
    "post": {
      "dynamic_templates": [
        {
          "dates": {
            "path_match": "NewImage.posted_at.N",
            "mapping": {
              "type": "date"
            }
          }
        },
        {
          "strings": {
            "match_mapping_type": "string",
            "mapping": {
              "type": "text",
              "fields": {
                "raw": {
                  "type":  "keyword",
                  "ignore_above": 256
                }
              }
            }
          }
        }
      ]
    }
  }
}'

Finally you can reindex your data through Dynamoose and you should be able to find a date field in Kibana afterwards.