diff --git a/src/main/java/net/geedge/asw/module/runner/util/PcapParserThread.java b/src/main/java/net/geedge/asw/module/runner/util/PcapParserThread.java index 8ac890a..4f04b95 100644 --- a/src/main/java/net/geedge/asw/module/runner/util/PcapParserThread.java +++ b/src/main/java/net/geedge/asw/module/runner/util/PcapParserThread.java @@ -28,6 +28,10 @@ import org.opensearch.client.opensearch.indices.IndexSettings; import java.io.File; import java.io.IOException; +import java.time.Instant; +import java.time.ZoneId; +import java.time.ZonedDateTime; +import java.time.format.DateTimeFormatter; import java.util.*; import java.util.stream.Collectors; @@ -341,16 +345,23 @@ public class PcapParserThread implements Runnable { .properties("version", Property.of(p2 -> p2.keyword(k -> k)))) ) ) - .properties("ts", Property.of(p -> p.float_(f -> f))) + .properties("ts", Property.of(p -> p.keyword(f -> f))) .properties("tunnel_parents", Property.of(p -> p.text(t -> t))) .properties("uid", Property.of(p -> p.keyword(k -> k))) ); openSearchClient.indices().create(createIndexRequestBuilder.build()); // upload data in bulk + DateTimeFormatter timeFormatter = DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm:ss.SSS"); + BulkRequest.Builder br = new BulkRequest.Builder(); for (int i = 0; i < jsonArray.size(); i++) { JSONObject jsonObject = (JSONObject) jsonArray.get(i); + + // 时间戳格式转换 + String ts = jsonObject.getString("ts"); + jsonObject.put("ts", this.convertTsToFormatDate(timeFormatter, ts)); + String id = String.valueOf(i); br.operations(op -> op.index( idx -> idx.index(indexName) @@ -374,6 +385,31 @@ public class PcapParserThread implements Runnable { } } + /** + * ts 时间戳格式转换 + * 1725518539.484784 -> 2024-09-05 06:42:19.484 + */ + private String convertTsToFormatDate(DateTimeFormatter formatter, String ts) { + try { + String[] parts = ts.split("\\."); + long seconds = Long.parseLong(parts[0]); + + // 将小数部分转换为纳秒 + int nanos = 0; + if (parts.length > 1) { + String fractionalPart = parts[1]; + nanos = (int) (Double.parseDouble("0." + fractionalPart) * 1_000_000_000); + } + + Instant instant = Instant.ofEpochSecond(seconds, nanos); + ZonedDateTime zonedDateTime = instant.atZone(ZoneId.systemDefault()); + return zonedDateTime.format(formatter); + } catch (Exception e) { + log.error(e, "[convertTsToFormatDate] [error] [ts: {}]", ts); + } + return ts; + } + /** * update pcap status *