fix(log-center): ES 时间戳双字段兼容 + AI助手按钮去重清理

backend/controller/log_proxy.go

@@ -22,7 +22,7 @@ type LogProxyHandler struct {
 	ds *LogDSHandler
 }
 
-const maxLogQueryLimit = 500 // 单次查询上限，防止平台承载过大数据 // Logan.Li
+const maxLogQueryLimit = 500
 
 func NewLogProxyHandler(ds *LogDSHandler) *LogProxyHandler {
 	return &LogProxyHandler{ds: ds}
@@ -149,19 +149,36 @@ func (h *LogProxyHandler) QueryES(c *gin.Context) {
 			},
 		}
 		if req.Start != "" || req.End != "" {
-			rangeQ := map[string]interface{}{"range": map[string]interface{}{"@timestamp": map[string]string{}}}
-			r := rangeQ["range"].(map[string]interface{})["@timestamp"].(map[string]string)
-			if req.Start != "" {
-				r["gte"] = req.Start
+			// ES 7.2 date_time 格式要求 +00:00 而非 Z；兼容 @timestamp 与 timestamp // Logan.Li
+			buildRangeVal := func(v string) string {
+				return strings.Replace(v, "Z", "+00:00", 1)
 			}
-			if req.End != "" {
-				r["lte"] = req.End
+			rangeCond := map[string]interface{}{
+				"bool": map[string]interface{}{
+					"should": []interface{}{
+						map[string]interface{}{"range": map[string]interface{}{"@timestamp": map[string]string{}}},
+						map[string]interface{}{"range": map[string]interface{}{"timestamp": map[string]string{}}},
+					},
+					"minimum_should_match": 1,
+				},
+			}
+			for _, clause := range rangeCond["bool"].(map[string]interface{})["should"].([]interface{}) {
+				rng := clause.(map[string]interface{})["range"].(map[string]interface{})
+				for _, v := range rng {
+					r := v.(map[string]string)
+					if req.Start != "" {
+						r["gte"] = buildRangeVal(req.Start)
+					}
+					if req.End != "" {
+						r["lte"] = buildRangeVal(req.End)
+					}
+				}
 			}
 			searchBody["query"] = map[string]interface{}{
 				"bool": map[string]interface{}{
 					"must": []interface{}{
 						searchBody["query"],
-						rangeQ,
+						rangeCond,
 					},
 				},
 			}
@@ -200,6 +217,8 @@ func parseLogTime(s string) (time.Time, error) {
 		}
 		return time.Unix(n, 0), nil
 	}
+	// ES 7.2 date_time 不接受 Z，转 +00:00
+	s = strings.Replace(s, "Z", "+00:00", 1)
 	return time.Parse(time.RFC3339, s)
 }
 
@@ -287,4 +306,4 @@ func pickESMessage(src map[string]interface{}) string {
 		return string(b[:500]) + "..."
 	}
 	return string(b)
-}
+}