0
因此,我想從某個時間以來獲取所有事件,例如自"2017-03-02T21:56:53.033Z"
以來。通過Logstash中的時間戳查詢項目
我做了一個runtime_timestamp
字段,它只是複製了@timestamp
字段,因爲我將這些數據解析到C#中,並且@
符號在那裏播放不好。
這是我的Logstash過濾器,它工作。我知道這是一個事實。
filter {
mutate {
add_field => ["runtime_timestamp", "%{@timestamp}"]
}
}
這是我現在擁有的,那是行不通的。
{
"query": {
"range": {
"runtime_timestamp":
"2017-03-02T21:56:53.033Z"
},
"_source": {
"includes": [
"runtime_timestamp",
"id_orig_p",
"id_orig_p",
"id_orig_h",
"conn_state",
"id_resp_h",
"id_resp_p",
"service",
"proto",
"tags"
]
},
"sort": [
{
"@timestamp": {
"order": "desc"
}
}
]
}
現在,我從此查詢中得到以下錯誤。
{
"error" : {
"root_cause" : [
{
"type" : "parsing_exception",
"reason" : "[range] query does not support [runtime_timestamp]",
"line" : 5,
"col" : 9
}
],
"type" : "parsing_exception",
"reason" : "[range] query does not support [runtime_timestamp]",
"line" : 5,
"col" : 9
},
"status" : 400
}
我代替runtime_timestamp
嘗試這種查詢也與timestamp
,我仍然得到同樣的錯誤。
這解決了我的問題,謝謝! – BenjaFriend