es用python增加字段_使用Python在ElasticSearch中添加@timestamp字段

我正在使用Python在本地ElasticSearch中添加条目(localhost：9200)

目前,我使用这种方法：

def insertintoes(data):

"""

Insert data into ElasicSearch

:param data: dict

:return:

"""

timestamp = data.get('@timestamp')

logstashIndex = 'logstash-' + timestamp.strftime("%Y.%m.%d")

es = Elasticsearch()

if not es.indices.exists(logstashIndex):

# Setting mappings for index

mapping = '''

{

"mappings": {

"_default_": {

"_all": {

"enabled": true,

"norms": false

},

"dynamic_templates": [

{

"message_field": {

"path_match": "message",

"match_mapping_type": "string",

"mapping": {

"norms": false,

"type": "text"

}

}

},

{

"string_fields": {

"match": "*",

"match_mapping_type": "string",

"mapping": {

"fields": {

"keyword": {

"type": "keyword"

}

},

"norms": false,

"type": "text"

}

}

}

],

"properties": {

"@timestamp": {

"type": "date",

"include_in_all": true

},

"@version": {

"type": "keyword",

"include_in_all": true

}

}

}

}

}

'''

es.indices.create(logstashIndex, ignore=400, body=mapping)

es.index(index=logstashIndex, doc_type='system', timestamp=timestamp, body=data)

data是一个dict结构,其有效的@timestamp定义为此数据[‘@timestamp’] = datetime.datetime.now()

问题是,即使我的数据中存在时间戳值,Kibana也不会在“发现”字段中显示该条目.

标签：python,elasticsearch,kibana