Question

我的类型中有几个date fields。我想在这些日期字段上运行script，找到2个日期之间的持续时间。

脚本将日期字段作为字符串，并且不提供此类属性：millis for class。我相信弹性搜索商店在epoch millis的日期。

这是我正在尝试的脚本

ctx._source.duraton = ctx._source.sessionTerminationDateTime.value.millis - ctx._source.eventConversionDateTime.value.millis

这是我的映射

 "access-event-logs": {
    "mappings": {
      "session-summary": {
        "dynamic_templates": [
          {
            "long_1": {
              "mapping": {
                "type": "long"
              },
              "match": "generation"
            }
          },
          {
            "datetime_1": {
              "mapping": {
                "format": "strict_date_optional_time||epoch_millis",
                "type": "date"
              },
              "match": "*DateTime"
            }
          },
          {
            "string_1": {
              "mapping": {
                "index": "not_analyzed",
                "type": "string"
              },
              "match": "*"
            }
          }
        ],
        "properties": {
          "eventConversionDateTime": {
            "type": "date",
            "format": "strict_date_optional_time||epoch_millis"
          },
          "generation": {
            "type": "long"
          },
          "hostname": {
            "type": "string",
            "index": "not_analyzed"
          },
          "sessionKey": {
            "type": "string",
            "index": "not_analyzed",
            "include_in_all": false
          },
          "sessionTerminationDateTime": {
            "type": "date",
            "format": "strict_date_optional_time||epoch_millis"
          },

        }
      }
    }
  }
}

如何在2个日期字段之间获得毫秒的持续时间

doc['eventConversionDateTime'].date.getMillis(). 
{
"_index":"access-event-logs",
"_type":"session-summary",
"_id":"c2de4a9dkarabip1new.lab.fp.f5net.com",
"_version":1,
"found":true,
"_source":{
"sessionKey":"c2de4a9dkarabip1new.lab.fp.f5net.com",
"eventConversionDateTime":"2016-01-06T16:08:43.047-08:00",
"badIpReputation":false,
"virtualServer":"/Common/access_virtual",
"lastUpdateMicros":0
}
}

Answer 1

您可以将string转换为date，这对我有用

POST /access-event-logs/session-summary/1/_update
{
  "script": "ctx._source.duration=new Date().parse(\"yyyy-MM-dd HH:mm:ss.SSS\",ctx._source.eventConversionDateTime.replace(\"T\", \" \").substring(0,23)).getTime();"
}

希望这会有所帮助!!

弹性搜索脚本将日期作为字符串

1 个答案: