From b037e46f8e99a68d80c2dbd73915626bd7e556ed Mon Sep 17 00:00:00 2001 From: shizhendong Date: Fri, 6 Sep 2024 18:36:20 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20=E8=B0=83=E6=95=B4=20opensearch-dashboar?= =?UTF-8?q?d=20=E5=B1=95=E7=A4=BA=E5=AD=97=E6=AE=B5=20ts(float),time(keywo?= =?UTF-8?q?rd,format=3D"yyyy-MM-dd'T'HH:mm:ss.SSSZ")?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../geedge/asw/module/runner/util/PcapParserThread.java | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/src/main/java/net/geedge/asw/module/runner/util/PcapParserThread.java b/src/main/java/net/geedge/asw/module/runner/util/PcapParserThread.java index 4f04b95..9e223c8 100644 --- a/src/main/java/net/geedge/asw/module/runner/util/PcapParserThread.java +++ b/src/main/java/net/geedge/asw/module/runner/util/PcapParserThread.java @@ -345,22 +345,23 @@ public class PcapParserThread implements Runnable { .properties("version", Property.of(p2 -> p2.keyword(k -> k)))) ) ) - .properties("ts", Property.of(p -> p.keyword(f -> f))) + .properties("ts", Property.of(p -> p.float_(f -> f))) + .properties("time", Property.of(p -> p.keyword(f -> f))) .properties("tunnel_parents", Property.of(p -> p.text(t -> t))) .properties("uid", Property.of(p -> p.keyword(k -> k))) ); openSearchClient.indices().create(createIndexRequestBuilder.build()); // upload data in bulk - DateTimeFormatter timeFormatter = DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm:ss.SSS"); + DateTimeFormatter timeFormatter = DateTimeFormatter.ofPattern("yyyy-MM-dd'T'HH:mm:ss.SSSZ"); BulkRequest.Builder br = new BulkRequest.Builder(); for (int i = 0; i < jsonArray.size(); i++) { JSONObject jsonObject = (JSONObject) jsonArray.get(i); // 时间戳格式转换 - String ts = jsonObject.getString("ts"); - jsonObject.put("ts", this.convertTsToFormatDate(timeFormatter, ts)); + String formatDate = this.convertTsToFormatDate(timeFormatter, jsonObject.getString("ts")); + jsonObject.put("time", formatDate); String id = String.valueOf(i); br.operations(op -> op.index(