@timestamp range query in elasticsearch

Question

Can I make a range query on default timestamp field ignoring date values i.e. using only time in timestamp - say 2 hours of each day?

My intentions are to search for all the documents but exclude the documents indexed between 9 PM and 12 AM (I have seen example with date ranges in filtering).

timestamp example stands following:

"@timestamp": [
                  "2015-12-21T15:18:17.120Z"
               ]

Elasticsearch version: 1.5.2

Adonis · Accepted Answer · 2017-03-20 15:18:32Z

1

My first idea would be to use the date math in Elasticsearch query, e.g. if you run your query at 1PM, this would work:

{
  "query": {
      "range" : {
            "@timestamp" : {
                "gte": "now-16h/h", 
                "lte": "now-1h/h"

            }
        }
  }
}

(watch out for the timezone though).

As far as I know, the only other possibility would be to use scripting.

Please note also that you are running a very old version of Elasticsearch.

Edit If you need simply absolute date, then check how your @timestamp field look, and use the same format, for instance on my Elasticsearch, it would be:

{
  "query": {
      "range" : {
            "@timestamp" : {
                "gte": "2015-03-20T01:21:00.01Z", 
                "lte": "2015-03-21T01:12:00.04Z"

            }
        }
  }
}

edited Mar 20, 2017 at 15:18

answered Mar 20, 2017 at 14:40

Adonis

4,8183 gold badges41 silver badges62 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Umer Over a year ago

intentionally, I wrote a date with year 2015 (its not like I am querying every day, I can query for a year old data)

Adonis Over a year ago

Basically you just need to be careful as how are formatted your date, then you can simply use the same formatting with a range querw, see my edited version

Collectives™ on Stack Overflow

@timestamp range query in elasticsearch

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related