Elasticsearch: count documents from query match

Question

I would like to get the number of documents that matches a specific string within a time range.

How can I specify a time range from this query?

GET myindex/_count
{
  "query": {
            "match" : {
            "log" : "ERROR"
        }
  }
}

To get a time range:

{
  "query": {
    "range": {
      "msgSubmissionTime": {
        "gte": "now-10m",
        "lt": "now"
      }
    }
  }
}

Is there a way to combine both queries?

Green · Accepted Answer · 2018-10-15 05:27:11Z

1

The guys above me are correct, but they both added redundant [,] for the must which implies a query of more than on match field.

GET _search
{
  "query": {
    "bool" : {
      "must" : {
        "match" : {  "log": "ERROR" }
      },
     "filter": 
        {
          "range": {
            "msgSubmissionTime": {
               "gte": "now-10m",
               "lte": "now"
            }
          }
        }
    }
  }
}

answered Oct 15, 2018 at 5:27

Green

2,5653 gold badges27 silver badges48 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Arkon Over a year ago

Works great, thanks a lot! Had to use time instead of msgSubmissionTime for my case but it works.

Green Over a year ago

Happy to hear(:

Alex Baidan · Accepted Answer · 2018-10-15 05:20:51Z

0

Sure you can. It can be done in two ways: with filtering and boolean query.

Elastic recommends to use filters to prefilter results - they are faster then queries.

Boolean queries can geather different queries by AND, OR, NOT operators.

In official Elastic docs you can find example that almost fits your question - elasticsearch documentation

So your query will be like:

{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "log": "ERROR"
          }
        }
      ],
      "filter": {
        "range": {
          "msgSubmissionTime": {
            "gte": "now-10m",
            "lte": "now"
          }
        }
      }
    }
  }
}

answered Oct 15, 2018 at 5:20

Alex Baidan

1,0757 silver badges15 bronze badges

Comments

Ashwani Shakya · Accepted Answer · 2018-10-15 05:22:13Z

0

try this.

{
  "query": {
    "bool": {
      "filter": {
        "range": {
          "msgSubmissionTime": {
            "gte": "now-10m",
            "lt": "now"
          }
        }
      },
      "must": [
        {
          "term": {
            "log" : "ERROR"
          }
        }
      ]
    }
  }
}

answered Oct 15, 2018 at 5:22

Ashwani Shakya

4394 silver badges13 bronze badges

Collectives™ on Stack Overflow

Elasticsearch: count documents from query match

3 Answers 3

2 Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

2 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related