Elasticsearch query_string with date math

Question

I'm trying to do a date range query with date math in Elasticsearch and it's not returning any results:

`query: {
    bool: {
        must: {
            query_string: {
                query: "created_at:[now-1m/d TO now/d+1d]", default_operator: "AND", analyzer: "my_text"}
            }
        }
    }
}`

Changing the query to include actual date does work: "created_at:[2017-07-25 TO 2017-08-25]"

I also tried a workaround by combining a query_string with a range query, but that didn't return any results either:

`query: {
    bool: {
        must: [
            {query_string: {query: "", default_operator: "AND", analyzer: "my_text"}}, 
            {range: {"created_at"=>{from: "now-1m/d", to: "now/d+1d"}}}]
        }
    }
}`

Use of date math does show the correct counts in aggs:

`aggs: {
    created_at: {
        date_range: {
            field: "created_at", keyed: true, ranges: [
                {from: "now/d", to: "now/d+1d", key: "Today"}, 
                {from: "now-1d/d", to: "now/d+1d", key: "In the last day"}, 
                {from: "now-7d/d", to: "now/d+1d", key: "In the last week"}, 
                {from: "now-1M/d", to: "now/d+1d", key: "In the last month"}
            ]
        }
    }
}`

Does date math work with Elasticsearch query_string query? And if not what is the right workaround?

dshockley · Accepted Answer · 2017-08-26 07:45:57Z

2

I think you have a capitalization typo -- m should be M: [now-1M/d TO now/d+1d] (capitalization is correct in your last example, that's why it works there).

answered Aug 26, 2017 at 7:45

dshockley

1,49410 silver badges13 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

painbot Over a year ago

You are correct, but even when I change it to a M it still returns 0 results. query: {query_string: {query: "created_at:[now-1M/d TO now/d+1d]", default_operator: "AND", analyzer: "my_text"}.... I tried playing around with a few different options both 30d and 1Y work so I guess there's some issue with Month date math. These both work: "created_at:[now-30d/d TO now/d+1d]", "created_at:[now-1Yd/d TO now/d+1d]"

Collectives™ on Stack Overflow

Elasticsearch query_string with date math

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related