弹性搜索列表符合时间范围的匹配条件的所有键

Question

我必须搜索ES以在匹配时间段的条件时打印出字段。

尝试了以下查询以匹配最后24小时的数字，但没有给我输出

{
    "query": {
        "bool": {
            "must": {
                "match_phrase": {
                    "Number": "1234567"
                }
            },
            "filter": {
                "range": {
                    "@timestamp": {
                        "gte": "now-1d/d"
                    }
                }
            }
        }
    }
}' 

我正在寻找列出最后24小时中所有数字的查询。有没有办法获得它。

我正在搜索的索引的映射是：

{
  "_index": "data-changes",
  "_type": "_doc",
  "_id": “123456”,
  "_version": 132,
  "_score": 0,
  "_source": {
    "work_notes": "",
    "priority": "4 - Low",
    "planned_start": 1557464400000,
    "Updated_by": "system",
    "Updated": 1557464427000,
    "description": “test of 123456“,
    "phase": "Requested",
    "Number": “123456”,
    "cmdb_ci": "",
    "review_status": "",
    "impact": "No - No impact",
    "phase_state": "Open",
    "Requested_by": “guest”,
    "requested_by_group": “guest_ninja”,
    "Short_description": “ninja rollout“,
    "risk": "Low",
    "actual_end": 0,
    "knowledge_id": "",
    "change_manager_group": “ninja_world_one”,
    "approval": "Approved",
    "downtime": "false",
    "close_notes": "",
    "Standard_template_version": "",
    "User_input": "",
    "ci_class": "Application",
    "category": "Other",
    "created_on": 1557426592000,
    "Created_by": “guest”,
    "Opened_by": “guest”,
    "State": "Implement",
    "availability_impacted": "None expected",
    "planned_end": 1557478800000,
    "close_code": null,
    "actual_start": 1557464427000,
    "closed_by": "",
    "Record_url": “http://localhost:8080”,
    "Type": "Normal"
  },
  "fields": {
    "planned_start": [
      "2019-05-10T05:00:00.000Z"
    ],
    "actual_start": [
      "2019-05-10T05:00:27.000Z"
    ],
    "actual_end": [
      "1970-01-01T00:00:00.000Z"
    ],
    "Updated": [
      "2019-05-10T05:00:27.000Z"
    ],
    "created_on": [
      "2019-05-09T18:29:52.000Z"
    ]
  },

Answer 1

您的查询不会返回任何内容，因为您的文档中没有任何@timestamp字段。您需要使用现有的日期字段，例如planned_start：

{
    "query": {
        "bool": {
            "must": {
                "match_phrase": {
                    "Number": "1234567"
                }
            },
            "filter": {
                "range": {
                    "planned_start": {
                        "gte": "now-1d/d"
                    }
                }
            }
        }
    }
}'