elasticsearch - Kibana 4和相对时间过滤器/JSON输入

Question

当前正在尝试创建具有实时用户信息(当前用户数，他们在哪里工作等)的Kibana仪表板，而我在按时限制虚拟化方面遇到了麻烦。

我在过滤器中尝试过

@timestamp:[now-6M/M TO now]

并在json输入字段中

{
    "range" : {
         "@timestamp" : {
             "gte": "now-6d",
             "lte": "now" 
         }
     }
 }

但是，它不起作用，并且出现以下错误。

我曾经有过这项工作，尽管Elasticseach1.6 +和Kibana4的版本不同

我试图通过添加启用groovy脚本

script.disable_dynamic: false

到yml文件，但这似乎不是问题。有没有提示或相对时间范围不再可用？

错误:

Error: Request to Elasticsearch failed: {"error":"SearchPhaseExecutionException[Failed to execute phase [query], all shards failed; shardFailures {[bzqrC3gbSPi7fp0OWh81VQ][logstash-2015.02.14][0]: SearchParseException[[logstash-2015.02.14][0]: query[ConstantScore(BooleanFilter(+cache(@timestamp:[1437289456709 TO 1439881456710])))],from[-1],size[0]: Parse Failure [Failed to parse source [{\"size\":0,\"query\":{\"filtered\":{\"query\":{\"query_string\":{\"query\":\"\",\"analyze_wildcard\":true}},\"filter\":{\"bool\":{\"must\":[{\"range\":{\"@timestamp\":{\"gte\":1437289456709,\"lte\":1439881456710}}}],\"must_not\":[]}}}},\"aggs\":{\"1\":{\"cardinality\":{\"field\":\"fields.UserName.raw\",\"range\":{\"timestamp\":{\"gte\":\"now-6d\",\"lte\":\"now\"}}}}}}]]]; nested: SearchParseException[[logstash-2015.02.14][0]: query[ConstantScore(BooleanFilter(+cache(@timestamp:[1437289456709 TO 1439881456710])))],from[-1],size[0]: Parse Failure [Unexpected token START_OBJECT in 1.]]; }{[bzqrC3gbSPi7fp0OWh81VQ][logstash-2015.02.15][0]: SearchParseException[[logstash-2015.02.15][0]: query[ConstantScore(BooleanFilter(+cache(@timestamp:[1437289456709 TO 1439881456710])))],from[-1],size[0]: Parse Failure [Failed to parse source [{\"size\":0,\"query\":{\"filtered\":{\"query\":{\"query_string\":{\"query\":\"\",\"analyze_wildcard\":true}},\"filter\":{\"bool\":{\"must\":..................................................... at http://kibana:5601/index.js?_b=7489:43092:38 at Function.Promise.try (http://kibana:5601/index.js?_b=7489:46434:26) at http://kibana:5601/index.js?_b=7489:46412:27 at Array.map (native) at Function.Promise.map (http://kibana:5601/index.js?_b=7489:46411:30) at callResponseHandlers (http://kibana:5601/index.js?_b=7489:43064:22) at http://kibana:5601/index.js?_b=7489:43182:16 at wrappedCallback (http://kibana:5601/index.js?_b=7489:20893:81) at wrappedCallback (http://kibana:5601/index.js?_b=7489:20893:81) at http://kibana:5601/index.js?_b=7489:20979:26

在Windows 2012r2(JRE 1.8.0.31)上使用Kibana 4.1.1和Elasticsearch 1.7

Answer 1

您可以使用时间范围过滤器，例如:

timestamp:[now-6M/M TO now]

获取最近6个月的数据。