what does mean now/d elasticsearch

user_5582655 0
Viewed 3069

what exactly is it now-1d/d or now/d in elastic search, Below is an example query

GET /_search
{
    "query": {
        "range" : {
            "timestamp" : {
                "gte" : "now-1d/d",
                "lt" :  "now/d"
            }
        }
    }
}
elasticsearch
1 Answers

it will take the current timestamp(time when your query reaches to Elasticsearch) and deduct the 1 day timestamp and bring the document in that range.

These types of queries are useful when you don't want to specify the exact time and want to get data of last 1 day, 3 day, 7 day, 1 month etc.

As mentioned in official doc of range query

now is always the current system time in UTC.

Taken example from official doc of datemath

Assuming now is 2001-01-01 12:00:00, some examples are:

now+1h now in milliseconds plus one hour. Resolves to: 2001-01-01 13:00:00

now-1h now in milliseconds minus one hour. Resolves to: 2001-01-01 11:00:00

now-1h/d now in milliseconds minus one hour, rounded down to UTC 00:00. Resolves to: 2001-01-01 00:00:00

2001.02.01||+1M/d 2001-02-01 in milliseconds plus one month. Resolves to: 2001-03-01 00:00:00

user_40394310
Related