fix: 调整 opensearch-dashboard 展示字段 ts(float),time(keyword,format="yyyy-MM-dd'T'HH:mm:ss.SSSZ")
This commit is contained in:
@@ -345,22 +345,23 @@ public class PcapParserThread implements Runnable {
|
|||||||
.properties("version", Property.of(p2 -> p2.keyword(k -> k))))
|
.properties("version", Property.of(p2 -> p2.keyword(k -> k))))
|
||||||
)
|
)
|
||||||
)
|
)
|
||||||
.properties("ts", Property.of(p -> p.keyword(f -> f)))
|
.properties("ts", Property.of(p -> p.float_(f -> f)))
|
||||||
|
.properties("time", Property.of(p -> p.keyword(f -> f)))
|
||||||
.properties("tunnel_parents", Property.of(p -> p.text(t -> t)))
|
.properties("tunnel_parents", Property.of(p -> p.text(t -> t)))
|
||||||
.properties("uid", Property.of(p -> p.keyword(k -> k)))
|
.properties("uid", Property.of(p -> p.keyword(k -> k)))
|
||||||
);
|
);
|
||||||
openSearchClient.indices().create(createIndexRequestBuilder.build());
|
openSearchClient.indices().create(createIndexRequestBuilder.build());
|
||||||
|
|
||||||
// upload data in bulk
|
// upload data in bulk
|
||||||
DateTimeFormatter timeFormatter = DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm:ss.SSS");
|
DateTimeFormatter timeFormatter = DateTimeFormatter.ofPattern("yyyy-MM-dd'T'HH:mm:ss.SSSZ");
|
||||||
|
|
||||||
BulkRequest.Builder br = new BulkRequest.Builder();
|
BulkRequest.Builder br = new BulkRequest.Builder();
|
||||||
for (int i = 0; i < jsonArray.size(); i++) {
|
for (int i = 0; i < jsonArray.size(); i++) {
|
||||||
JSONObject jsonObject = (JSONObject) jsonArray.get(i);
|
JSONObject jsonObject = (JSONObject) jsonArray.get(i);
|
||||||
|
|
||||||
// 时间戳格式转换
|
// 时间戳格式转换
|
||||||
String ts = jsonObject.getString("ts");
|
String formatDate = this.convertTsToFormatDate(timeFormatter, jsonObject.getString("ts"));
|
||||||
jsonObject.put("ts", this.convertTsToFormatDate(timeFormatter, ts));
|
jsonObject.put("time", formatDate);
|
||||||
|
|
||||||
String id = String.valueOf(i);
|
String id = String.valueOf(i);
|
||||||
br.operations(op -> op.index(
|
br.operations(op -> op.index(
|
||||||
|
|||||||
Reference in New Issue
Block a user