Kibana筛选数据自动减去了8小时,怎么办?

来源:19-2 -Discover实战

蒋犇犇

2021-06-28

使用Discover查看inspect,做range筛选的时候,时间自动减少了8个小时

{
  "size": 500,
  "sort": [
    {
      "date": {
        "order": "desc",
        "unmapped_type": "boolean"
      }
    }
  ],
  "version": true,
  "fields": [
    {
      "field": "*",
      "include_unmapped": "true"
    },
    {
      "field": "date",
      "format": "strict_date_optional_time"
    }
  ],
  "aggs": {
    "2": {
      "date_histogram": {
        "field": "date",
        "fixed_interval": "5m",
        "time_zone": "Asia/Shanghai",
        "min_doc_count": 1
      }
    }
  },
  "script_fields": {},
  "stored_fields": [
    "*"
  ],
  "runtime_mappings": {},
  "_source": false,
  "query": {
    "bool": {
      "must": [],
      "filter": [
        {
          "match_all": {}
        },
        {
          "range": {
            "date": {
              "gte": "2021-06-28T03:28:26.485Z",
              "lte": "2021-06-28T06:28:26.485Z",
              "format": "strict_date_optional_time"
            }
          }
        }
      ],
      "should": [],
      "must_not": []
    }
  },
  "highlight": {
    "pre_tags": [
      "@kibana-highlighted-field@"
    ],
    "post_tags": [
      "@/kibana-highlighted-field@"
    ],
    "fields": {
      "*": {}
    },
    "fragment_size": 2147483647
  }
}
写回答

1回答

rockybean

2021-06-28

2021-06-28T03:28:26.485Z

这个最后的 Z 是代表零时区,我们是东八区,所以实际用的还是当前的时间。默认kibana 使用浏览器时区


0
2
rockybean
回复
蒋犇犇
你如果是用代码写入的沪啊,用时间戳也就是 epoch_millis 是最保险的,否则就要符合 stric_date_optional_time 的format,定义,可以参考这里 https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-date-format.html#built-in-date-formats A generic ISO datetime parser, where the date must include the year at a minimum, and the time (separated by T), is optional. Examples: yyyy-MM-dd'T'HH:mm:ss.SSSZ or yyyy-MM-dd 如果你发的日期没有 最后的 Z,也就是 zone的信息,那它就按照零时区处理了。所以两个方案: 1. 以时间戳来写入,到毫秒级别 2. 以符合格式化要求的format 写入
2021-06-29
共2条回复

Elastic Stack从入门到实践,动手搭建数据分析系统

有了Elastic Stack,不用写一行代码,你也可以玩转大数据分析!

1361 学习 · 397 问题

查看课程