[英]Kibana not recognizing Elastic Search date field
I am an ElasticSearch / Kibana noob, and am trying my best to teach myself the fundamentals of this service. 我是ElasticSearch / Kibana noob,并且正在尽力向自己介绍这项服务的基础知识。 I am trying to insert some Keyword
documents into my AWS ElasticSearch service. 我正在尝试将一些Keyword
文档插入我的AWS ElasticSearch服务中。 The document is pretty straightforward. 该文档非常简单。 It contains 它包含
created_at
a datetime field created_at
日期时间字段 updated_at
: a datetime field updated_at
: 日期时间字段 keyword
: the actual keyword itself, a string such as watercolors
or romanticism
keyword
:实际的关键字本身,例如watercolors
或romanticism
的字符串 user_id
: the user who created this keyword user_id
:创建此关键字的用户 Using the Kibana dev console, I've defined the mapping for this index using a PUT
request, and then sent this GET
request to check that it is valid ( GET /keyword_index/_mapping/Keyword
): 使用Kibana开发人员控制台,我已使用PUT
请求定义了此索引的映射,然后发送了此GET
请求以检查其是否有效( GET /keyword_index/_mapping/Keyword
):
{
"keyword_index": {
"mappings": {
"Keyword": {
"properties": {
"_created_at": {
"type": "date",
"format": "yyyy-MM-dd HH:mm:ss"
},
"_updated_at": {
"type": "date",
"format": "yyyy-MM-dd HH:mm:ss"
},
"keyword": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
},
"userId": {
"type": "text",
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
}
}
}
}
I've successfully inserted records into /keyword_index/Keyword
, using the following POST
request (from a Python script): 我已使用以下POST
请求(来自Python脚本)将记录成功插入/keyword_index/Keyword
:
POST MY_ES_SERVICE_ADDRESS/keyword_index/Keyword/FzaGCiZl68/_create
{"keyword": "Comedy", "userId": "hjkJVM4TjD12N", "_created_at": "2017-12-28 02:52:14", "_updated_at": "2017-12-28 02:52:14"}
Here is a sample result from executing a match_all
query: 这是执行match_all
查询的示例结果:
{
"took": 3,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 332,
"max_score": 1,
"hits": [
{
"_index": "keyword_index",
"_type": "Keyword",
"_id": "HCQAm97kbs",
"_score": 1,
"_source": {
"keyword": "Controlled",
"userId": "",
"_created_at": "2017-10-12 06:01:14",
"_updated_at": "2017-10-12 06:01:14"
}
}, ... more results below not shown...
However, Kibana doesn't recognize my datetime fields when I attempt to create an index mapping: 但是,当我尝试创建索引映射时,Kibana无法识别我的日期时间字段:
Moreover, when I inspect the fields within Kibana, I see a bunch of fields I did not create mappings for, nor inserted when I sent my POST
request. 此外,当我检查Kibana中的字段时,我看到了一些字段,这些字段我没有为其创建映射,也没有在发送POST
请求时插入。 And, more importantly, I don't see my date fields at all: 而且,更重要的是,我根本看不到日期字段:
I found a similar SO post here, but the accepted answer was to click a "refresh fields" orange button in the Kibana Management console, but I see no such thing. 我在这里找到了类似的帖子 ,但是可以接受的答案是在Kibana Management控制台中单击“刷新字段”橙色按钮,但是我看不到这种东西。
Where did my date fields go? 我的日期字段去哪里了? And why are they not recognized by Kibana? 为什么他们不被基巴纳认可?
I believe I found the culprit. 我相信我找到了罪魁祸首。 Fields that begin with an underscore, such as _created_at
do not show in Kibana, as I discovered in this Github issue . 正如我在本Github问题中所发现的那样,以下划线开头的字段(例如_created_at
未显示在Kibana中。
I simply changed my mappings from _created_at
to created_at
and _updated_at
to updated_at
and this issue was resolved. 我只是将映射从_created_at
更改为created_at
,将_updated_at
为updated_at
,此问题已解决。
I don't really mind, since I understand the need to differentiate between internal and user-facing fields, but maybe some more prominent documentation within Kibana could help save us some headache and time? 我并不介意,因为我了解区分内部字段和面向用户字段的必要性,但是也许Kibana中一些更出色的文档可以帮助我们节省一些头痛和时间?
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.