0

I am trying to create a filter for my query using a date range and a time range. In my case, date and time are different fields. So I want to run queries like: Show me all the events happening this month (15-10-01/15-10-30) between 10:00:00 am and 12:00:00

This is my query, but it is not working. Note: If I only use the "date part" it works, but with the combination of the time field, the results are wrong.

Any suggestion?

{"query": {
    "filtered": {
         "query": {
             "match": { "message" : "error" }
         },
         "filter": {
             "bool" : {
                 "must" : {
                     "range": {
                         "date": {
                             "gte": "15-11-01",
                             "lte": "15-11-30"
                         }
                     }
                 },
                 "must" : {
                     "range": {
                         "time": {
                             "gte": "10:00:00",
                             "lte": "12:00:00"
                         }
                 }
             }
         }
     }
  }
}
}

Update: Running the command:

curl -XGET localhost:9200/my_index/_mapping

As some of you suggested, I could discover that ES is defining the "time" field type as string and not as (date) time. Additionally, as it was pointed in the first answer, my query syntax was wrong.

4
  • Does elasticsearch support the time format, i.e. does it know how to apply lte and gte to times of day? Nov 3, 2015 at 20:30
  • What mapping do you have for time? Nov 3, 2015 at 21:38
  • In the logstash config file, those fields are mapped in this way: %{DATE:date} %{TIME:time}
    – xtingray
    Nov 3, 2015 at 23:09
  • What @AndreiStefan referred to was the mapping you have in your Elasticsearch server, i.e. what you get with curl -XGET localhost:9200/your_index/_mapping
    – Val
    Nov 4, 2015 at 4:03

1 Answer 1

0

One thing that is not correct is that you have two must clause inside your bool filter. That is not valid JSON and so that might be the reason why your query doesn't work, try the following query instead which has the two range filters inside the bool/must filter:

{
  "query": {
    "filtered": {
      "query": {
        "match": {
          "message": "error"
        }
      },
      "filter": {
        "bool": {
          "must": [
            {
              "range": {
                "date": {
                  "gte": "15-11-01",
                  "lte": "15-11-30"
                }
              }
            },
            {
              "range": {
                "time": {
                  "gte": "10:00:00",
                  "lte": "12:00:00"
                }
              }
            }
          ]
        }
      }
    }
  }
}
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.