datetime - 插入日期为epoch_seconds，输出为格式化日期

Question

我有一组时间戳记，自该纪元以来以秒为单位。我想以epoch_seconds的形式插入到ElasticSearch中，但是在查询时希望将输出看成一个漂亮的日期，例如strict_date_optional_time。

我的下方映射保留了输入的格式-是否有任何方法可以通过mapping API将输出标准化为一种格式？

当前映射:

PUT example
{
  "mappings": {
    "time": {
      "properties": {
        "time_stamp": {
          "type": "date",
          "format": "strict_date_optional_time||epoch_second"
        }
      }
    }
  }
}

示例文档

POST example/time
{
  "time_stamp": "2018-03-18T00:00:00.000Z"
}

POST example/time
{
  "time_stamp": "1521389162" // Would like this to output as: 2018-03-18T16:05:50.000Z
}

GET example / _search输出:

{
    "total": 2,
    "max_score": 1,
    "hits": [
      {
        "_source": {
          "time_stamp": "1521389162", // Stayed as epoch_second
        }
      },
      {
        "_source": {
          "time_stamp": "2018-03-18T00:00:00.000Z"
        }
      }
    ]
  }

Answer 1

Elasticsearch区分_source和所谓的存储字段。第一个应该代表您的输入。

如果您实际使用存储的字段(通过在映射中指定store=true)，然后指定multiple date formats，这很简单:(强调我的)

Multiple formats can be specified by separating them with || as a separator. Each format will be tried in turn until a matching format is found. The first format will be used to convert the milliseconds-since-the-epoch value back into a string.

我已经用elasticsearch 5.6.4测试了它，它工作正常:

PUT /test -d '{ "mappings": {"doc": { "properties": {"post_date": {
    "type":"date",
    "format":"basic_date_time||epoch_millis",
    "store":true
} } } } }'

PUT /test/doc/2 -d '{                                                                                                                            
    "user" : "test1",
    "post_date" : "20150101T121030.000+01:00"
}'

PUT /test/doc/1 -d '{                                                                                                                            
    "user" : "test2",
    "post_date" : 1525167490500
}'

请注意，使用 GET /test/_search?stored_fields=post_date&pretty=1时，两种不同的输入格式将如何导致相同的格式

{
    "hits" : [
      {
        "_index" : "test",
        "_type" : "doc",
        "_id" : "2",
        "_score" : 1.0,
        "fields" : {
          "post_date" : [
            "20150101T111030.000Z"
          ]
        }
      },
      {
        "_index" : "test",
        "_type" : "doc",
        "_id" : "1",
        "_score" : 1.0,
        "fields" : {
          "post_date" : [
            "20180501T093810.500Z"
          ]
        }
      }
    ]
}

如果您不想更改输入(使用 _source)，那么就不太幸运了，已删除了 mapping-transform功能:

This was deprecated in 2.0.0 because it made debugging very difficult. As of now there really isn’t a feature to use in its place other than transforming the document in the client application.

如果不想改变存储数据的格式，而只是对格式化输出感兴趣，请查看 this answer to Format date in elasticsearch query (during retrieval)