elasticsearch - 在 Elasticsearch 6.6 上执行查询时出现非法参数异常？

Question

嗨，我的机器上正在运行一个 Elasticsearch 实例。它有一个名为 mep-reports 的索引。当我使用 curl 命令进行查询时，它给出了一个错误。下面是 curl 命令。

 curl -X GET "10.10.9.1:9200/mep-reports*/_search?pretty&size=0" -H 'Content-Type: application/json' -d'{
  "size": 0,
  "query": {
    "bool": {
      "must": [
        {
          "range": {
            "@timestamp": {
              "from": "2019-01-31T23:59:59Z",
              "to": "2020-02-17T23:59:59Z",
              "include_lower": true,
              "include_upper": false,
              "format": "yyyy-MM-dd'T'HH:mm:ssZ",
              "boost": 1.0
            }
          }
        },
        {
          "term": {
            "account_id": {
              "value": "270d13e6-2f4f-4d51-99d5-92ffba5f0cb6",
              "boost": 1.0
            }
          }
        }
      ],
      "adjust_pure_negative": true,
      "boost": 1.0
    }
  },
  "aggregations": {
    "performance_over_time": {
      "date_histogram": {
        "field": "@timestamp",
        "format": "yyyy-MM-dd'T'HH:mm:ssZ",
        "interval": "1M",
        "offset": 0,
        "order": {
          "_key": "asc"
        },
        "keyed": false,
        "min_doc_count": 0
      }
    }
  }
}'

Response 
{
  "error" : {
    "root_cause" : [
      {
        "type" : "illegal_argument_exception",
        "reason" : "Invalid format: [yyyy-MM-ddTHH:mm:ssZ]: Illegal pattern component: T"
      }
    ],
    "type" : "illegal_argument_exception",
    "reason" : "Invalid format: [yyyy-MM-ddTHH:mm:ssZ]: Illegal pattern component: T",
    "caused_by" : {
      "type" : "illegal_argument_exception",
      "reason" : "Illegal pattern component: T"
    }
  },
  "status" : 400
}

以下是我的 Elasticsearch 索引中的示例

{
  "took" : 14,
  "timed_out" : false,
  "_shards" : {
    "total" : 12,
    "successful" : 12,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : 1073013,
    "max_score" : 1.0,
    "hits" : [
      {
        "_index" : "mep-reports-2019.09.11",
        "_type" : "doc",
        "_id" : "68e8e03f-baf8-4bfc-a920-58e26edf835c-353899837500",
        "_score" : 1.0,
        "_source" : {
          "account_id" : "270d13e6-2f4f-4d51-99d5-92ffba5f0cb6",
          "inventory" : "SMS",
          "flight_name" : "test flight 001",
          "status" : "ENROUTE",
          "msg_text" : "Test !!!!!!!!!!!!!!1 elastic searchY",
          "flight_id" : "68e8e03f-baf8-4bfc-a920-58e26edf835c",
          "submission_ts" : "1568197286",
          "recipient" : "353899837500",
          "o_error" : null,
          "nof_segments" : "-1",
          "campaign_id" : "0fae8662-bee9-46ac-9b3e-062f4ba55966",
          "campaign_name" : "Index search petri11",
          "@version" : "1",
          "sender" : "800111",
          "delivery_ts" : "0",
          "@timestamp" : "2019-09-11T10:21:26.000Z"
        }
      }
    ]
  }
}

它与日期格式有关，因为我正在尝试对 @timestamp 字段进行搜索
如果你能帮忙，真的很感激

谢谢你

Answer 1

问题是因为 JSON 查询被括在单引号中，即 T 周围的相同字符以您的日期格式。

我建议您将查询存储在名为 query.json 的文件中。然后像这样以二进制模式发送它:

curl -X GET "10.10.9.1:9200/mep-reports*/_search?pretty&size=0" -H 'Content-Type: application/json' --data-binary @query.json

那应该可以解决您的问题