Elasticsearch-“星期几”的DateTime映射 [英] Elasticsearch - DateTime mapping for 'Day of Week'

问题描述

我在一个类中具有以下属性：

I have the following property in a class:

public DateTime InsertedTimeStamp { get; set; }

在ES中具有以下映射

"insertedTimeStamp ":{
    "type":"date",
    "format":"yyyy-MM-ddTHH:mm:ssZ"
},

我想进行汇总，以返回日期为周，即星期一，星期二 ...等等

I would like to run an aggregation to return all the data grouped by the 'Day of the Week', i.e. 'Monday', 'Tuesday'...etc

我知道我可以在汇总调用中使用脚本来执行此操作， href = https://stackoverflow.com/questions/29002152/how-to-show-day-names-using-date-histogram-aggregation-in-elascticsearch>参阅此处，但据我了解，如果有很多文档（此处已过时，请考虑分析日志记录），则使用脚本不会对性能造成不小的影响。

I understand I can use a 'script' in the aggregation call to do this, see here, however, from my understanding, using a script has a not insignificant performance impact if there are alot of documents (which is anticpated here, think analytics logging).

有没有一种方法可以映射带有子属性的属性。即用一个字符串我可以做：

Is there a way I can map the property with 'sub properties'. I.e. with a string I can do:

"somestring":{
    "type":"string",
    "analyzer":"full_word",
    "fields":{
        "partial":{
            "search_analyzer":"full_word",
            "analyzer":"partial_word",
            "type":"string"
        },
        "partial_back":{
            "search_analyzer":"full_word",
            "analyzer":"partial_word_back",
            "type":"string"
        },
        "partial_middle":{
            "search_analyzer":"full_word",
            "analyzer":"partial_word_name",
            "type":"string"
        }
    }
},

在 .net 代码中都具有该类中的单个属性。

All with the single property in the class in the .net code.

我可以做一些类似的事情来分别存储完整日期，然后分别存储年，月和日等（在索引时间存储某种脚本），还是需要在存储中添加更多属性？上课并分别映射它们？这是 Transform 所做的事情吗？ （现在已贬值，因此似乎表明我需要单独的字段...）

Can I do something similar to store the 'full date' and then the 'year' and 'month' and 'day' etc separately (some sort of 'script' at index time), or will I need to make more properties in the class and map them individually? Is this what Transform did? (which is now depreciated hence seeming to indicate I need separate fields...)

推荐答案

绝对有可能在使用 pattern_capture 令牌过滤器。

It is definitely possible to do it at indexing time using a pattern_capture token filter.

您首先需要为每个日期部分定义一个分析器+令牌过滤器组合，并将每个分配给日期字段的一个子字段。每个令牌过滤器只会捕获其感兴趣的组。

You'd first define a one analyzer + token filter combo per date parts and assign each to a sub-field of your date field. Each token filter will only capture the group it is interested in.

{
  "settings": {
    "analysis": {
      "analyzer": {
        "year_analyzer": {
          "type": "custom",
          "tokenizer": "keyword",
          "filter": [
            "year"
          ]
        },
        "month_analyzer": {
          "type": "custom",
          "tokenizer": "keyword",
          "filter": [
            "month"
          ]
        },
        "day_analyzer": {
          "type": "custom",
          "tokenizer": "keyword",
          "filter": [
            "day"
          ]
        },
        "hour_analyzer": {
          "type": "custom",
          "tokenizer": "keyword",
          "filter": [
            "hour"
          ]
        },
        "minute_analyzer": {
          "type": "custom",
          "tokenizer": "keyword",
          "filter": [
            "minute"
          ]
        },
        "second_analyzer": {
          "type": "custom",
          "tokenizer": "keyword",
          "filter": [
            "second"
          ]
        }
      },
      "filter": {
        "year": {
          "type": "pattern_capture",
          "preserve_original": false,
          "patterns": [
            "(\\d{4})-\\d{2}-\\d{2}[tT]\\d{2}:\\d{2}:\\d{2}[zZ]"
          ]
        },
        "month": {
          "type": "pattern_capture",
          "preserve_original": false,
          "patterns": [
            "\\d{4}-(\\d{2})-\\d{2}[tT]\\d{2}:\\d{2}:\\d{2}[zZ]"
          ]
        },
        "day": {
          "type": "pattern_capture",
          "preserve_original": false,
          "patterns": [
            "\\d{4}-\\d{2}-(\\d{2})[tT]\\d{2}:\\d{2}:\\d{2}[zZ]"
          ]
        },
        "hour": {
          "type": "pattern_capture",
          "preserve_original": false,
          "patterns": [
            "\\d{4}-\\d{2}-\\d{2}[tT](\\d{2}):\\d{2}:\\d{2}[zZ]"
          ]
        },
        "minute": {
          "type": "pattern_capture",
          "preserve_original": false,
          "patterns": [
            "\\d{4}-\\d{2}-\\d{2}[tT]\\d{2}:(\\d{2}):\\d{2}[zZ]"
          ]
        },
        "second": {
          "type": "pattern_capture",
          "preserve_original": false,
          "patterns": [
            "\\d{4}-\\d{2}-\\d{2}[tT]\\d{2}:\\d{2}:(\\d{2})[zZ]"
          ]
        }
      }
    }
  },
  "mappings": {
    "test": {
      "properties": {
        "date": {
          "type": "date",
          "format": "yyyy-MM-dd'T'HH:mm:ssZ",
          "fields": {
            "year": {
              "type": "string",
              "analyzer": "year_analyzer"
            },
            "month": {
              "type": "string",
              "analyzer": "month_analyzer"
            },
            "day": {
              "type": "string",
              "analyzer": "day_analyzer"
            },
            "hour": {
              "type": "string",
              "analyzer": "hour_analyzer"
            },
            "minute": {
              "type": "string",
              "analyzer": "minute_analyzer"
            },
            "second": {
              "type": "string",
              "analyzer": "second_analyzer"
            }
          }
        }
      }
    }
  }
}

然后当您进入例如 2016-01-22T10：01：23Z 这样的日期，您将获得每个填充了相关部分的日期子字段，即

Then when you index a date such as 2016-01-22T10:01:23Z, you'll get each of the date sub-fields populated with the relevant part, i.e.

• date ： 2016-01-22T10：01：23Z


• date.year ： 2016


• date.month ： 01


• date.day ： 22


• date。小时： 10


• date.minute ： 01


• date.second ： 23

• date: 2016-01-22T10:01:23Z
• date.year: 2016
• date.month: 01
• date.day: 22
• date.hour: 10
• date.minute: 01
• date.second: 23

然后，您可以自由汇总这些子字段中的任何一个，以获取所需的内容。

You're then free to aggregate on any of those sub-fields to get what you want.

这篇关于Elasticsearch-“星期几”的DateTime映射的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！