es根据时间范围查询数据失效

Question

今天在使用es进行查询的时候遇到时间戳范围查询es数据导致，时间范围条件不成立，不知道是为什么。
这是es查询方法：

public SearchHits<SubReportPropertyMessage> searchByTimeRange(long startTime, long endTime) {
        BoolQueryBuilder queryBuilder = QueryBuilders.boolQuery();
        queryBuilder.must(QueryBuilders.rangeQuery("createTime")
                .gte(startTime)
                .lte(endTime));
        NativeSearchQuery searchQuery = new NativeSearchQueryBuilder()
                .withQuery(queryBuilder).build();
//        RangeQueryBuilder rangeQuery = QueryBuilders.rangeQuery("createTime")
//                .gte(startTime).lte(endTime);
//
//        NativeSearchQuery searchQuery = new NativeSearchQueryBuilder()
//                .withQuery(rangeQuery)
//                .build();

        // 执行查询并返回结果
        SearchHits<SubReportPropertyMessage> searchHits = elasticsearchRestTemplate.search(searchQuery, SubReportPropertyMessage.class);
        return searchHits;
    }

{
"_index": "abs_report_property",
"_type": "_doc",
"_id": "1373",
"_version": 1,
"_score": 1,
"_source": {
"_class": "com.hyzk.mqtt.client.domain.message.SubReportPropertyMessage",
"clientId": "2311220001",
"topic": "/sys/thing/node/property/post",
"deviceAddr": "KT0001G11",
"params": [
{
"deviceAddr": "KT0001G11",
"properties": "[{"name":"AirSet","value":2,"timestamp":1710724043},{"name":"Channel","value":0,"timestamp":1710724044},{"name":"ModeSet","value":0,"timestamp":1710724043},{"name":"Pa","value":0,"timestamp":1710724042},{"name":"RoomTemp","value":17.3,"timestamp":1710724042},{"name":"TempSet","value":20,"timestamp":1710724043},{"name":"Ua","value":230.6,"timestamp":1710724042},{"name":"Ic","value":0,"timestamp":1710724042},{"name":"NETID","value":0,"timestamp":1710724044},{"name":"RoomHumi","value":54,"timestamp":1710724042},{"name":"TotalEnergy","value":0,"timestamp":1710724042},{"name":"AirBrandID","value":40,"timestamp":1710724043},{"name":"Ia","value":6,"timestamp":1710724042},{"name":"Ib","value":0,"timestamp":1710724042},{"name":"Pb","value":0,"timestamp":1710724042},{"name":"Pc","value":0,"timestamp":1710724042},{"name":"SoftVer","value":133,"timestamp":1710724043},{"name":"StartStopSet","value":0,"timestamp":1710724043},{"name":"TotalTime","value":31458,"timestamp":1710724042},{"name":"Uc","value":0,"timestamp":1710724042},{"name":"DeviceType","value":2,"timestamp":1710724043},{"name":"OpeningCurrent","value":3,"timestamp":1710724044},{"name":"StartStopStatus","value":1,"timestamp":1710724042},{"name":"Ub","value":0,"timestamp":1710724042}]"
}
],
"topicMessageEnum": "absReportProperty",
"createTime": 1710724493704,
"id": "1373",
"version": "V1.0",
"ack": 1
}
}

Answer 1

引自免费微信小程序：皆我百晓生

看起来你在Elasticsearch中进行时间范围查询时遇到了问题。从你提供的信息来看，可能的原因有几个：

1. 时间字段格式不正确：Elasticsearch可能无法识别createTime字段的时间戳格式。
2. 索引映射问题：检查索引设置，确保createTime字段被正确地映射为日期类型。
3. 数据质量问题：确认存储的数据中确实有在给定时间范围内创建的文档。

首先，我们需要确保createTime字段在索引映射中定义为日期类型。如果你没有明确指定，Elasticsearch可能会将其默认处理为字符串或其他类型。请检查你的索引映射，确保createTime字段被正确映射为日期。例如，一个正确的映射可能是这样的：

PUT /abs_report_property
{
  "mappings": {
    "properties": {
      "createTime": {
        "type": "date"
      }
    }
  }
}

接下来，确认你的数据中确实存在在给定时间范围内的文档。你可以通过Kibana或Elasticsearch API执行一个简单的聚合查询来验证这一点：

GET abs_report_property/_search
{
  "size": 0,
  "aggs": {
    "time_range": {
      "range": {
        "field": "createTime",
        "ranges": [
          { "from": "now-1h", "to": "now" },
          { "from": "now-1d", "to": "now-1h" }
        ]
      }
    }
  }
}

这个查询会返回不同时间范围内的文档数量。如果在给定的时间范围内没有找到任何文档，那可能是数据本身的问题。

至于代码方面，你的查询逻辑看起来没有明显错误。不过，为了简化，可以尝试使用Java高版本API（比如6.x 或者更高）中的RangeQueryBuilder，这将使代码更易读：

import org.elasticsearch.index.query.RangeQueryBuilder;

public SearchHits<SubReportPropertyMessage> searchByTimeRange(long startTime, long endTime) {
    RangeQueryBuilder rangeQuery = new RangeQueryBuilder("createTime")
            .gte(startTime)
            .lte(endTime);

    NativeSearchQueryBuilder searchQuery = new NativeSearchQueryBuilder()
            .withQuery(rangeQuery)
            .build();

    // 执行查询并返回结果
    SearchHits<SubReportPropertyMessage> searchHits = elasticsearchRestTemplate.search(searchQuery, SubReportPropertyMessage.class);
    return searchHits;
}

如果以上步骤都检查过了，但问题仍然存在，请提供更多的日志信息或者查询结果，以便进一步分析。