使用索引
pattern_capture过滤器在索引编制时绝对可以做到这一点。
首先,您需要为每个日期部分定义一个分析器+令牌过滤器组合,并将每个分配给日期字段的子字段。每个令牌过滤器将仅捕获其感兴趣的组。
{ "settings": { "analysis": { "analyzer": { "year_analyzer": { "type": "custom", "tokenizer": "keyword", "filter": [ "year" ] }, "month_analyzer": { "type": "custom", "tokenizer": "keyword", "filter": [ "month" ] }, "day_analyzer": { "type": "custom", "tokenizer": "keyword", "filter": [ "day" ] }, "hour_analyzer": { "type": "custom", "tokenizer": "keyword", "filter": [ "hour" ] }, "minute_analyzer": { "type": "custom", "tokenizer": "keyword", "filter": [ "minute" ] }, "second_analyzer": { "type": "custom", "tokenizer": "keyword", "filter": [ "second" ] } }, "filter": { "year": { "type": "pattern_capture", "preserve_original": false, "patterns": [ "(\d{4})-\d{2}-\d{2}[tT]\d{2}:\d{2}:\d{2}[zZ]" ] }, "month": { "type": "pattern_capture", "preserve_original": false, "patterns": [ "\d{4}-(\d{2})-\d{2}[tT]\d{2}:\d{2}:\d{2}[zZ]" ] }, "day": { "type": "pattern_capture", "preserve_original": false, "patterns": [ "\d{4}-\d{2}-(\d{2})[tT]\d{2}:\d{2}:\d{2}[zZ]" ] }, "hour": { "type": "pattern_capture", "preserve_original": false, "patterns": [ "\d{4}-\d{2}-\d{2}[tT](\d{2}):\d{2}:\d{2}[zZ]" ] }, "minute": { "type": "pattern_capture", "preserve_original": false, "patterns": [ "\d{4}-\d{2}-\d{2}[tT]\d{2}:(\d{2}):\d{2}[zZ]" ] }, "second": { "type": "pattern_capture", "preserve_original": false, "patterns": [ "\d{4}-\d{2}-\d{2}[tT]\d{2}:\d{2}:(\d{2})[zZ]" ] } } } }, "mappings": { "test": { "properties": { "date": { "type": "date", "format": "yyyy-MM-dd'T'HH:mm:ssZ", "fields": { "year": { "type": "string", "analyzer": "year_analyzer" }, "month": { "type": "string", "analyzer": "month_analyzer" }, "day": { "type": "string", "analyzer": "day_analyzer" }, "hour": { "type": "string", "analyzer": "hour_analyzer" }, "minute": { "type": "string", "analyzer": "minute_analyzer" }, "second": { "type": "string", "analyzer": "second_analyzer" } } } } } }}然后,当您为日期编入索引(例如)时
2016-01-22T10:01:23Z,您将获得每个填充了相关部分的日期子字段,即
date
:2016-01-22T10:01:23Z
date.year
:2016
date.month
:01
date.day
:22
date.hour
:10
date.minute
:01
date.second
:23
然后,您可以随意在任何这些子字段上进行汇总以获得所需的内容。



