Elasticsearch query range last 15min

user_9358877 0
Viewed 251

I'm trying to create a simple query to return matching deploymentId from the documents in index logstash.

I'm able to search match query but when adding time range getting following exemption.

Error:

"type" : "parsing_exception",
"reason" : "[match] malformed query, expected [END_OBJECT] but found [FIELD_NAME]",

I want only the last 15 min records matching the deploymentId.

GET /logstash-dev-2021.12.03/_search
{
  "query": {
    "match": {
      "deploymentId" : "64a5d214-368c-4760"
    }, 
    "range": {
      "time": {
        "gte": "now-15m",
        "lte": "now"
      }
    }
  }
}
elasticsearch
1 Answers

I don't think you can use range and match in the same query,

You could try to use a boolean query.

GET /logstash-dev-2021.12.03/_search
{
  "query": {
    "bool": {
      "filter": [
        {
          "range": {
            "time": {
              "gte": "now-15m",
              "lte": "now"
            }
          }
        }
      ],
      "must": [
        {
          "match": {
            "deploymentId" : "64a5d214-368c-4760"
          }
        }
      ]
    }
  }
}
user_45349230
Related