I'm using a curl query to try to get data from my elasticsearch instance. All my indices and types have a field call @timestamp which use the "strict_date_optional_time" format. But everytime I try to use a range filter on that field, my queries fail.
The query I execute :
curl 'localhost:X/logstash-*/traces_console/_search' -d '{
"query" : {
"bool": {
"must": [
{ "match_all": {} }
],
"filter": [
{ "range":
{ "@timestamp":
"gte": "2018-02-20T13:55:06.387Z",
"lte": "2018-02-23T13:55:06.387Z"
}
}
]
}}
}'
The error message :
"reason":{
"type":"query_parsing_exception",
"reason":"[range] query does not support [@timestamp]",
"index":"logstash-2018.02.06","line":10,"col":21
}
I don't understand why this error keep popping. When i looked upon most of what was already published regarding this, all the people using date format have working queries. If you have any hint or clue about why it does not work I will apreciate.
Here some informations that can be useful :
Environment
Mapping generated from logstash
"traces_console":{
"properties":{
"@timestamp":{
"type":"date",
"format":"strict_date_optional_time||epoch_millis"
},
"@version":{"type":"string"},
"Method":{"type":"string"},
"RequestSize":{"type":"string"},
"ResponseSize":{"type":"string"},
"ResponseTime":{"type":"string"},
"SubSystem":{"type":"string"},
"column1":{"type":"string"},
"column2":{"type":"string"},
"column3":{"type":"string"},
"column4":{"type":"string"},
"column5":{"type":"string"},
"host":{"type":"string"},
"path":{"type":"string"},
"type":{"type":"string"}
}
}
Logstash configuration file feeding elasticsearch
input {
file {
path => "LOG_PATH/TRACES_CONSOLE.log"
start_position => "beginning"
type => "traces_console"
}
}
filter {
csv {
separator => ";"
columns => ["Method","RequestSize","ResponseSize","ResponseTime","SubSystem"]
source => message
convert => {
"RequestSize" => "date"
"ResponseSize" => "date"
}
remove_field => ["message"]
}
}
output {
elasticsearch {
hosts => ["localhost:X"]
}
}
Your Range Query syntax is not correct, you need extra curly braces:
{ "range":
{ "@timestamp": {
"gte": "2018-02-20T13:55:06.387Z",
"lte": "2018-02-23T13:55:06.387Z"
}
}
}
The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.