ElasticSearch requests range timestamp in python

Question

I'm trying to perform a request on my ES, to count logs in a timestamp range. My request works, but she returns always the same result. The timestamp filter seems not working. I would to retrieve a facet by status_code for my servertest01 in a custom timestamp range.

import rawes
from datetime import datetime
from dateutil import tz
paristimezone = tz.gettz('Europe/Paris')

es = rawes.Elastic('127.0.0.1:9200')

result = es.get('/_search', data={
    "query" : { "match_all" : {}
              },
    "filter": {
        "range": {
           "@timestamp": {
              "from": datetime(2013, 3, 11, 8, 0, 30,   tzinfo=paristimezone),
               "to": datetime(2013, 3, 12, 11, 0, 30, tzinfo=paristimezone)}
                  }
           },
   "facets" : {
       "error" : {
        "terms" : {
            "field" : "status_code"
        },
         "facet_filter" : {
            "term" : {"server" : "testserver01"}
           }
        }
    }
})

print(result['facets'])

And in my ES data, the timestamp field is like this:

"@timestamp":"2013-03-12T00:02:29+01:00"

Thanks :)

DrTech · Accepted Answer · 2013-03-14 10:11:00Z

4

The filter element in the search API is used to filter query results AFTER facets have been calculated.

If you want to apply the filter both to the query and to the facets, then you should use a filtered query instead:

result = es.get('/_search', data={
    "query": {
        "filtered": {
            "query" : { "match_all" : {}},
            "filter": {
                "range": {
                   "@timestamp": {
                      "from": datetime(2013, 3, 11, 8, 0, 30,   tzinfo=paristimezone),
                       "to": datetime(2013, 3, 12, 11, 0, 30, tzinfo=paristimezone)
                    }
                }
            }
        }
    },           
   "facets" : {
       "error" : {
        "terms" : {
            "field" : "status_code"
        },
         "facet_filter" : {
            "term" : {"server" : "testserver01"}
           }
        }
    }
})

answered Mar 14, 2013 at 10:11

DrTech

17.4k5 gold badges56 silver badges48 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Matt Over a year ago

Yeah! Thanks a lot :) It's works very well. And thanks for the explication!

Shashwat Swain Over a year ago

I get a TypeError for the datetime object as it's not JSON serializable. What type of datetime string format does it expect?

Collectives™ on Stack Overflow

ElasticSearch requests range timestamp in python

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related