如何在 ELK 中启用 date_nanos 功能？

Question

我需要在 ELK 中启用 date_nanos 支持但失败了。

我使用 docker 来调出 elastic + kibana + filebeat。 Elastic的版本是7.9.0。

我设置了一个filebeat的模板，它只是从原始fields.yml复制而来，我只是将日期类型更改为“date_nanos”，如下所示。

- key: ecs
  title: ECS
  description: ECS Fields.
  fields:
  - name: '@timestamp'
    level: core
    required: true
    type: date_nanos
...

然后我启用了filebeat的调试日志，日志显示映射已加载到elastic：

{"level":"info","timestamp":"2020-09-03T09:25:02.360Z","caller":"template/load.go:109","message":"Try loading template filebeat-7.9.0 to Elasticsearch"},
{"level":"debug","timestamp":"2020-09-03T09:25:02.364Z","logger":"esclientleg","caller":"eslegclient/connection.go:364","message":"PUT http://elasticsearch:9200/_template/filebeat-7.9.0  map[index_patterns:[filebeat-7.9.0-*] mappings:{\"_meta\":{\"beat\":\"filebeat\",\"version\":\"7.9.0\"},\"date_detection\":false,\"dynamic_templates\":[{\"labels\":{\"mapping\":{\"type\":\"keyword\"},\"match_mapping_type\":\"string\",\"path_match\":\"labels.*\"}},{\"container.labels\":{\"mapping\":{\"type\":\"keyword\"},\"match_mapping_type\":\"string\",\"path_match\":\"container.labels.*\"}},{\"dns.answers\":{\"mapping\":{\"type\":\"keyword\"},\"match_mapping_type\":\"string\",\"path_match\":\"dns.answers.*\"}},{\"log.syslog\":{\"mapping\":{\"type\":\"keyword\"},\"match_mapping_type\":\"string\",\"path_match\":\"log.syslog.*\"}},{\"network.inner\":{\"mapping\":{\"type\":\"keyword\"},\"match_mapping_type\":\"string\",\"path_match\":\"network.inner.*\"}},{\"observer.egress\":{\"mapping\":{\"type\":\"keyword\"},\"match_mapping_type\":\"string\",\"path_match\":\"observer.egress.*\"}},{\"observer.ingress\":{\"mapping\":{\"type\":\"keyword\"},\"match_mapping_type\":\"string\",\"path_match\":\"observer.ingress.*\"}},{\"fields\":{\"mapping\":{\"type\":\"keyword\"},\"match_mapping_type\":\"string\",\"path_match\":\"fields.*\"}},{\"docker.container.labels\":{\"mapping\":{\"type\":\"keyword\"},\"match_mapping_type\":\"string\",\"path_match\":\"docker.container.labels.*\"}},{\"kubernetes.labels.*\":{\"mapping\":{\"type\":\"keyword\"},\"match_mapping_type\":\"*\",\"path_match\":\"kubernetes.labels.*\"}},{\"kubernetes.annotations.*\":{\"mapping\":{\"type\":\"keyword\"},\"match_mapping_type\":\"*\",\"path_match\":\"kubernetes.annotations.*\"}},{\"docker.attrs\":{\"mapping\":{\"type\":\"keyword\"},\"match_mapping_type\":\"string\",\"path_match\":\"docker.attrs.*\"}},{\"kibana.log.meta\":{\"mapping\":{\"type\":\"keyword\"},\"match_mapping_type\":\"string\",\"path_match\":\"kibana.log.meta.*\"}},{\"strings_as_keyword\":{\"mapping\":{\"ignore_above\":1024,\"type\":\"keyword\"},\"match_mapping_type\":\"string\"}}],\"properties\":{\"@timestamp\":{\"type\":\"date_nanos\"},\"agent\":{\"properties\":{\"ephemeral_id\":{\"ignore_above\":1024,\"type\":\"keyword\"},
{"level":"info","timestamp":"2020-09-03T09:25:02.846Z","caller":"template/load.go:101","message":"template with name 'filebeat-7.9.0' loaded."},

我可以在日志字符串中看到 date_nanos 设置：

"properties\":{\"@timestamp\":{\"type\":\"date_nanos\"},

但最后 Kibana 中日期的“类型”仍然显示“日期”而不是“日期纳米”

我还能做些什么来启用 date_nanos 支持？

Answer 1

索引模式中显示的Date 类型与索引映射中的date_nanos 类型不同。索引模式中的Date 类型更多用于格式化目的。

Kibana 支持date_nanossince version 7.3。

所以你已经可以走了，没什么可改变的。