elasticsearch - 文档和时间戳存在，但Kibana在 “Discover”选项卡中未显示任何结果

Question

我的Elasticsearch引擎中有一些文档:

在Kibana中，我成功创建了一个索引模式，包括建议的时间范围。

在最近5年中搜索文档时-找不到任何东西。

如果我正在创建没有时间字段的索引模式-我可以看到所有文档。

每个_source内容都有文档。

我真的很绝望，有人可以协助吗？

编辑过

对应:

{ "settings" : { "number_of_shards" : 1 }, "mappings" : { "monitor" : { "properties" : { "ProcessName": { "type": "string", "index": "analyzed" }, "OpName": { "type": "string", "index": "analyzed" }, "Domain": { "type": "string", "index": "not_analyzed" }, "TraceType": { "type": "string", "index": "not_analyzed" }, "TraceDateTime": { "type": "date", "format": "yyyy-MM-dd HH:mm:ss" }, "ApplicationCode": { "type": "string", "index": "not_analyzed" }, "SrcMessageID": { "type": "string", "index": "not_analyzed" }, "ProcessID": { "type": "string", "index": "not_analyzed" }, "OpID": {"type": "string", "index": "not_analyzed" }, "OpParentID": { "type": "string", "index": "not_analyzed" }, "HostName": { "type": "string", "index": "not_analyzed"} } } } }

文件范例:

{
        "_index": "monitors",
        "_type": "monitor",
        "_id": "AVPkvD3YnwEx8EXuppEN",
        "_score": 1,
        "_source": {
          "ProcessName": "myapp",
          "OpName": "myop",
          "Domain": "mydomain",
          "TraceType": "Info",
          "TraceDateTime": "2016-04-05 07:44:15",
          "ApplicationCode": "71",
          "SrcMessageID": "35e291e9-10ad-47a2-8ce8-935cebc62b26",
          "ProcessID": "a017afa9-c541-4424-bc63-c83a3d8830e0",
          "OpID": "84267eed-38db-4d84-88c4-f46d148e494a",
          "HostName": "myHost"
        }

编辑2

{"index":[".kibana-devnull"],"ignore_unavailable":true}
{"size":500,"sort":[{"TraceDateTime":{"order":"desc","unmapped_type":"boolean"}}],"highlight":{"pre_tags":["@kibana-highlighted-field@"],"post_tags":["@/kibana-highlighted-field@"],"fields":{"*":{}},"require_field_match":false,"fragment_size":2147483647},"query":{"filtered":{"query":{"query_string":{"query":"*","analyze_wildcard":true}},"filter":{"bool":{"must":[{"range":{"TraceDateTime":{"gte":1301984031628,"lte":1459836831628,"format":"epoch_millis"}}}],"must_not":[]}}}},"aggs":{"2":{"date_histogram":{"field":"TraceDateTime","interval":"1M","time_zone":"Asia/Jerusalem","min_doc_count":0,"extended_bounds":{"min":1301984031627,"max":1459836831627}}}},"fields":["*","_source"],"script_fields":{},"fielddata_fields":["TraceDateTime"]}

Answer 1

问题是我在格林尼治标准时间+03:00发送日期时间，而日期时间以UTC时区存储在elasticsearch中。