ElasticSearch 无法解析日期字段

Question

I have the following query that I'm trying to run on Elasticsearch 5.6 in Kibana Dev Tools:

{
  "query": {
    "bool": {
      "filter": {
        "bool": {
          "must": [
            {
              "range": {
                "inserted": {
                  "gt": "Thu Aug 20 09:01:31 +0100 2020"
                }
              }
            }
          ]
        }
      }
    }
  }
}

the response I'm getting is:

{
  "error": {
    "root_cause": [
      {
        "type": "parse_exception",
        "reason": "failed to parse date field [Thu Aug 20 09:01:31 +0100 2020] with format [EEE MMM dd HH:mm:ss ZZZ yyyy]"
      }
    ],
    "type": "search_phase_execution_exception",
    "reason": "all shards failed",
    "phase": "can_match",
    "grouped": true,

The datetime format looks correct to me, what am I doing wrong?

Answer 1

In Short: 'EEE MMM dd HH:mm:ss Z yyyy' is the correct format.

Details:

1. Elastic Search uses Joda library for formatting DateTime.

Excerpt from ES Docs

Completely customizable date formats are supported. The syntax for these is explained in the Joda docs.

2. Try formatting DateTime with the pattern you are using "EEE MMM dd HH:mm:ss ZZZ yyyy" using Joda library. Programming language is Java

 DateTimeFormatter formatter = DateTimeFormat.forPattern("EEE MMM dd HH:mm:ss ZZZ yyyy"); DateTime dateTime = formatter.parseDateTime("Thu Aug 20 09:01:31 +0100 2020");

It is resulting in below exception:

Exception in thread "main" java.lang.IllegalArgumentException: Invalid format: "Thu Aug 20 09:01:31 +0100 2020" is malformed at "+0100 2020" at org.joda.time.format.DateTimeFormatter.parseDateTime(DateTimeFormatter.java:866)

Deduction: There is something wrong with the format defined by 'ZZZ'

From JodaDoc

Z time zone offset/id zone -0800

3. Based on the investigation correct format is "EEE MMM dd HH:mm:ss Z yyyy" and not "EEE MMM dd HH:mm:ss ZZZ yyyy".

4. Considering #3 define format in your mapping like

{ "mappings": { "_doc":{ "properties": { "inserted":{ "type": "date", "format": "EEE MMM dd HH:mm:ss Z yyyy" } } } } }