How to combine query_string and range of timestamp in elasticsearch

Question

I have two query. One is searching in logmessage and second time in range of timestamp.

query = {
    "query": {
        "query_string" : {
            "query" : "logmessage:test"
        }
    }

and

query = {
    "query": {
"range" : {
            "@timestamp" : {
                "lte" : "2017-08-04"
            }                   
        }
    }

How I can create one with both options ? I tried this:

    query = {
        "query": {
            "query_string" : {
                "query" : "logmessage:test"
            },
    "range" : {
                "@timestamp" : {
                    "gte" : "2017-08-04",
                    "lte" : "now"
                }                   
            }
        }
    }

but with no success. There is some 400 error because of bad syntax I guess

MartinSchulze · Accepted Answer · 2017-08-04 13:52:02Z

6

You are looking for a bool query https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-bool-query.html. You can compose multiple queries into one using should, must, must_not and filter clauses:

{
  "query": {
    "bool": {
      "must": [
        {
          "range": {
            "@timestamp": {
              "lte": "2017-08-04"
            }
          }
        },
        {
          "query_string": {
            "query": "logmessage:test"
          }
        }
      ]
    }
  }
}

edited Aug 4, 2017 at 13:52

answered Aug 4, 2017 at 13:22

MartinSchulze

8971 gold badge7 silver badges15 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

hudi Over a year ago

hi man it is another problem but you can help me again. I noticed that I sill got just 2000 result in query. How I can change to get more

MartinSchulze Over a year ago

size:3000 should do the trick elastic.co/guide/en/elasticsearch/reference/current/…

hudi Over a year ago

ok never mind paramter in query is overided what I wrote as es.search parameter

Collectives™ on Stack Overflow

How to combine query_string and range of timestamp in elasticsearch

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related