在使用kibana发现模式时,我们发现了一个令人关注的结果。
对于给定的索引,在特定的时间范围内,发现了这样一种情况:当筛选字段“时间戳”(Map到long)等于特定值(1545287341)时,它返回两个文档:一个具有精确值,另一个接近。
这怎么可能?唯一返回的文档应具有指定的值?elasticsearch的这种不准确响应的可能原因是什么?非常感谢您的帮助,因为这很有诱惑力。
我在这里捕获kibana发送的查询。
{
"version": true,
"size": 500,
"sort": [{
"@timestamp": {
"order": "desc",
"unmapped_type": "boolean"
}
}],
"_source": {
"excludes": []
},
"aggs": {
"2": {
"date_histogram": {
"field": "@timestamp",
"interval": "3h",
"time_zone": "Etc/UTC",
"min_doc_count": 1
}
}
},
"stored_fields": ["*"],
"script_fields": {},
"docvalue_fields": ["@timestamp", "day"],
"query": {
"bool": {
"must": [{
"match_all": {}
}, {
"match_phrase": {
"dev_id.keyword": {
"query": "22170821152"
}
}
}, {
"match_phrase": {
"time_stamp": {
"query": 1545287341
}
}
}, {
"range": {
"@timestamp": {
"gte": 1544659200000,
"lte": 1545350399999,
"format": "epoch_millis"
}
}
}],
"filter": [],
"should": [],
"must_not": []
}
},
"highlight": {
"pre_tags": ["@kibana-highlighted-field@"],
"post_tags": ["@/kibana-highlighted-field@"],
"fields": {
"*": {}
},
"fragment_size": 2147483647
}
}
显示接近但不准确响应的(修订)响应也在这里:
{
"responses": [{
"took": 2,
"timed_out": false,
"_shards": {
"total": 10,
"successful": 10,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 2,
"max_score": null,
"hits": [{
"_index": "pkt-2018-12",
"_type": "doc",
"_id": "CzvHahOE1jrv+tFWGorFH4gV6cs=",
"_version": 1,
"_score": null,
"_source": {
"time_stamp": 1.545287341E9,
"@timestamp": "2018-12-20T06:29:01.000Z",
},
"fields": {
"@timestamp": ["2018-12-20T06:29:01.000Z"]
},
"highlight": {
"dev_id.keyword": ["@kibana-highlighted-field@22170821152@/kibana-highlighted-field@"]
},
"sort": [1545287341000]
}, {
"_index": "pkt-2018-12",
"_type": "doc",
"_id": "PbeMWFMNpvwrjnZpBJtexDwfE9k=",
"_version": 1,
"_score": null,
"_source": {
"time_stamp": 1.545287281E9,
"@timestamp": "2018-12-20T06:28:01.000
},
"fields": {
"@timestamp": ["2018-12-20T06:28:01.000Z"]
},
"highlight": {
"dev_id.keyword": ["@kibana-highlighted-field@22170821152@/kibana-highlighted-field@"]
},
"sort": [1545287281000]
}]
},
"aggregations": {
"2": {
"buckets": [{
"key_as_string": "2018-12-20T06:00:00.000Z",
"key": 1545285600000,
"doc_count": 2
}]
}
},
"status": 200
}]
}
暂无答案!
目前还没有任何答案,快来回答吧!