回避策は、マッピングのオプションcopy_toを使用して、created_dateフィールドを別のテキストフィールドにコピーすることです。次の例に示すように テキストフィールドは、pattern_replace char型のフィルタを使用して月日、年を抽出するために分析することができます。
例:
put test
{
"settings": {
"analysis": {
"char_filter": {
"year" : {
"type": "pattern_replace",
"pattern": "(\\d{4})-(\\d{2})-(\\d{2})T\\d{2}:\\d{2}:\\d{2}.\\d{3}Z",
"replacement": "$1"
},
"month" : {
"type": "pattern_replace",
"pattern": "(\\d{4})-(\\d{2})-(\\d{2})T\\d{2}:\\d{2}:\\d{2}.\\d{3}Z",
"replacement": "$2"
},
"day" : {
"type": "pattern_replace",
"pattern": "(\\d{4})-(\\d{2})-(\\d{2})T\\d{2}:\\d{2}:\\d{2}.\\d{3}Z",
"replacement": "$3"
}
},
"analyzer": {
"year" : {
"tokenizer" : "keyword",
"char_filter" : ["year"]
},
"month" : {
"tokenizer" : "keyword",
"char_filter" : ["month"]
},
"day" : {
"tokenizer" : "keyword",
"char_filter" : ["day"]
}
}
}
}
}
put test/message_logs/_mapping
{
"message_logs": {
"properties": {
"@timestamp": {
"type": "date"
},
"changed_date": {
"type": "date"
},
"created_date": {
"type": "date",
"copy_to" : ["year","month","day"]
},
"year": {
"type": "text",
"analyzer" : "year",
"search_analyzer":"keyword",
"store" : true,
"fielddata":true
},
"month": {
"type": "text",
"analyzer" : "month",
"search_analyzer":"keyword",
"store" : true,
"fielddata":true
},
"day": {
"type": "text",
"analyzer" : "day",
"search_analyzer":"keyword",
"store" : true,
"fielddata":true
}
}
}
}
put test/message_logs/1
{
"created_date" : "2016-11-22T22:20:21.000Z"
}
post test/message_logs/_search
{
"fielddata_fields": [
"year",
"month",
"day"
]
}
結果:
{
"took": 3,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"failed": 0
},
"hits": {
"total": 1,
"max_score": 1,
"hits": [
{
"_index": "test",
"_type": "message_logs",
"_id": "1",
"_score": 1,
"_source": {
"created_date": "2016-11-22T22:20:21.000Z"
},
"fields": {
"month": [
"11"
],
"year": [
"2016"
],
"day": [
"22"
]
}
}
]
}
}
fielddata
はtrue
である必要はなく、例の目的にのみ有効です。