范围查询中不支持Elasticsearch字段

我使用curl查询尝试从elasticsearch实例中获取数据。我的所有索引和类型都有一个使用“strict\u date\u optional\u time”格式的字段调用@timestamp。但每次我尝试在该字段上使用范围过滤器时,我的查询都会失败。

我执行的查询:

curl 'localhost:X/logstash-*/traces_console/_search' -d '{
"query" : {
    "bool": {
        "must": [
            { "match_all": {} }
        ],
        "filter": [
            { "range":
                { "@timestamp": 
                    "gte": "2018-02-20T13:55:06.387Z",
                    "lte": "2018-02-23T13:55:06.387Z"
                }
            }
        ]
    }}
}'

错误消息:

"reason":{
    "type":"query_parsing_exception",
    "reason":"[range] query does not support [@timestamp]",
    "index":"logstash-2018.02.06","line":10,"col":21
}

我不明白为什么这个错误不断出现。当我查看大多数已经发布的关于此的内容时,所有使用日期格式的人都有工作查询。如果你有任何关于它为什么不起作用的提示或线索,我将不胜感激。

以下是一些有用的信息:

环境

• 操作系统: Red Hat Enterprise Linux Server 6.5版(圣地亚哥)
• Java: 1.7
• Elasticsearch: 2.4
• 日志存储: 2.4

从logstash生成的映射

"traces_console":{
    "properties":{
        "@timestamp":{
            "type":"date",
            "format":"strict_date_optional_time||epoch_millis"
        },
        "@version":{"type":"string"},
        "Method":{"type":"string"},
        "RequestSize":{"type":"string"},
        "ResponseSize":{"type":"string"},
        "ResponseTime":{"type":"string"},
        "SubSystem":{"type":"string"},
        "column1":{"type":"string"},
        "column2":{"type":"string"},
        "column3":{"type":"string"},
        "column4":{"type":"string"},
        "column5":{"type":"string"},
        "host":{"type":"string"},
        "path":{"type":"string"},
        "type":{"type":"string"}
    }
}

Logstash配置文件馈送elasticsearch

input {
  file {
    path => "LOG_PATH/TRACES_CONSOLE.log"
    start_position => "beginning"
    type => "traces_console"
  }
}

filter {
  csv {
    separator => ";"
    columns => ["Method","RequestSize","ResponseSize","ResponseTime","SubSystem"]
    source => message
    convert => {
      "RequestSize" => "date"
      "ResponseSize" => "date"
    }
    remove_field => ["message"]
  }
}

output {
  elasticsearch {
    hosts => ["localhost:X"]
  }
}