elasticsearch: problema al consultar a un rango de tiempo definido

Uriel Arenas 0
Viewed 16

I would like to know if there is a way to define a time range as follows.

With a watcher I am looking for records with a certain message within a field. The problem is that I want it to find the records 72 hours after they have been entered.

this is my code:

GET my_index/_search
{
  "query": {
    "bool": {
      "should": [
        {
          "match_phrase": {
            "status": {
              "query": "process"
            }
          }
        },
        {
          "match_phrase": {
            "estatus": {
              "query": "error"
            }
          }
        },
        {
         "range": {
            "date": {
              "gte": "now-72h",
              "time_zone": "-06:00"
            }
          }
        }
      ]
    }
  }
}

My problem is that the query always returns records that match the "status" field but without respecting the range (i.e. it can bring even older/newer records). I understand that by placing now I specify the current day. That said, how can I configure it to only fetch records from -72 hours? thank you community.

elasticsearch-query elasticsearch-plugin elasticsearch
1 Answers

As you are using should clause, it will match only any one of the condition and return result because by default minimum_should_match value is set to 1.

You can move your condition which you need to compulsory match to must clause and optional you can keep to should clause.

Below query will compulsory match date condition and any of the condition from the should clause.

{
  "query": {
    "bool": {
      "must": [
        {
          "range": {
            "date": {
              "gte": "now-72h",
              "time_zone": "-06:00"
            }
          }
        }
      ],
      "should": [
        {
          "match_phrase": {
            "status": {
              "query": "process"
            }
          }
        },
        {
          "match_phrase": {
            "estatus": {
              "query": "error"
            }
          }
        }
      ],
      "minimum_should_match": 1
    }
  }
}

Here, now-72h will give you the recoreds which are created in last 72 hours.

Sagar Patel0
Related