范围查询不支持Elasticsearch字段

Question

I'm using a curl query to try to get data from my elasticsearch instance. All my indices and types have a field call @timestamp which use the "strict_date_optional_time" format. But everytime I try to use a range filter on that field, my queries fail.

The query I execute :

curl 'localhost:X/logstash-*/traces_console/_search' -d '{
"query" : {
    "bool": {
        "must": [
            { "match_all": {} }
        ],
        "filter": [
            { "range":
                { "@timestamp": 
                    "gte": "2018-02-20T13:55:06.387Z",
                    "lte": "2018-02-23T13:55:06.387Z"
                }
            }
        ]
    }}
}'

The error message :

"reason":{
    "type":"query_parsing_exception",
    "reason":"[range] query does not support [@timestamp]",
    "index":"logstash-2018.02.06","line":10,"col":21
}

I don't understand why this error keep popping. When i looked upon most of what was already published regarding this, all the people using date format have working queries. If you have any hint or clue about why it does not work I will apreciate.

Here some informations that can be useful :

Environment

• OS: Red Hat Enterprise Linux Server release 6.5 (Santiago)
• Java: 1.7
• Elasticsearch: 2.4
• Logstash: 2.4

Mapping generated from logstash

"traces_console":{
    "properties":{
        "@timestamp":{
            "type":"date",
            "format":"strict_date_optional_time||epoch_millis"
        },
        "@version":{"type":"string"},
        "Method":{"type":"string"},
        "RequestSize":{"type":"string"},
        "ResponseSize":{"type":"string"},
        "ResponseTime":{"type":"string"},
        "SubSystem":{"type":"string"},
        "column1":{"type":"string"},
        "column2":{"type":"string"},
        "column3":{"type":"string"},
        "column4":{"type":"string"},
        "column5":{"type":"string"},
        "host":{"type":"string"},
        "path":{"type":"string"},
        "type":{"type":"string"}
    }
}

Logstash configuration file feeding elasticsearch

input {
  file {
    path => "LOG_PATH/TRACES_CONSOLE.log"
    start_position => "beginning"
    type => "traces_console"
  }
}

filter {
  csv {
    separator => ";"
    columns => ["Method","RequestSize","ResponseSize","ResponseTime","SubSystem"]
    source => message
    convert => {
      "RequestSize" => "date"
      "ResponseSize" => "date"
    }
    remove_field => ["message"]
  }
}

output {
  elasticsearch {
    hosts => ["localhost:X"]
  }
}

Answer 1

Your Range Query syntax is not correct, you need extra curly braces:

{ "range":
     { "@timestamp": {
           "gte": "2018-02-20T13:55:06.387Z",
           "lte": "2018-02-23T13:55:06.387Z"
       }
     }
 }