es 索引相关

es mapping 格式要求

es的index mapping定义了每个字段的格式, es query的时候也需要按照对应的格式去查询, 不然会报错parse_exception.

org.elasticsearch.ElasticsearchStatusException: Elasticsearch exception [type=illegal_argument_exception, reason=no write index is defined for alias [audit-operation-log]. The write index may be explicitly disabled using is_write_index=false or the alias points to multiple indices without one being designated as a write index]

date字段的默认格式

https://www.elastic.co/guide/en/elasticsearch/reference/current/date.html#date

Date formats can be customised, but if no format is specified then it uses the default:

 "strict_date_optional_time||epoch_millis"

This means that it will accept dates with optional timestamps, which conform to the formats supported by strict_date_optional_time or milliseconds-since-the-epoch.

https://www.elastic.co/guide/en/elasticsearch/reference/7.17/mapping-date-format.html#strict-date-time

date_optional_time or strict_date_optional_time

A generic ISO datetime parser, where the date must include the year at a minimum, and the time (separated by T), is optional. Examples: yyyy-MM-dd'T'HH:mm:ss.SSSZ`` or yyyy-MM-dd``.

也可以在index的时候, 注明date类型可以接受的自定义格式

PUT my-index-000001
{
  "mappings": {
    "properties": {
      "date": {
        "type":   "date",
        "format": "yyyy-MM-dd HH:mm:ss||yyyy-MM-dd||epoch_millis"
      }
    }
  }
}