how to give timestamp in range query Elasticsearch

Question

In Elastic-search range query , timestamp is in this 2019-08-28T08:57:04.749Z formate, when execute the following query it throws a error "Unrecognized chars at the end of [2019-08-28T08:57:04.749Z- 1h]. how can we minus 1 hr in lte value?

  {
 "query": {
 "range" : {
    "@timestamp" : {
        "gte": "2015-03-20T01:21:00.01Z", 
        "lte": "2015-03-20T01:12:00.04Z-1h"

      }
   }
 }

Val · Accepted Answer · 2019-09-18 09:20:37Z

2

The right way to do it is by adding a double pipe, like this:

{
 "query": {
 "range" : {
    "@timestamp" : {
        "gte": "2015-03-20T01:21:00.01Z", 
        "lte": "2015-03-20T01:12:00.04Z||-1h"

      }
   }
 }

However, you should note that your query won't return anything, because the to date is earlier than the from date.

answered Sep 18, 2019 at 9:20

Val

218k14 gold badges377 silver badges384 bronze badges

Sign up to request clarification or add additional context in comments.

8 Comments

malik Over a year ago

i set the from date but stil no result

Val Over a year ago

Can you tell which bounds you're now using and also show a document that you think should match?

Val Over a year ago

Try with gte: timestamp - "||1h"

Val Over a year ago

Sorry, forgot the minus sign: gte: timestamp + "||-1h"

Val Over a year ago

which is now correct, right? i.e. you'd get all documents from the past hour before 08:57:04.749Z

|

Collectives™ on Stack Overflow

how to give timestamp in range query Elasticsearch

1 Answer 1

8 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

8 Comments

Your Answer

Sign up or log in

Post as a guest

Related