CODEWITHSUNDEEP
pythontimestampelasticsearch
Matt
Matt

Reputation: 4387

ElasticSearch requests range timestamp in python

I'm trying to perform a request on my ES, to count logs in a timestamp range. My request works, but she returns always the same result. The timestamp filter seems not working. I would to retrieve a facet by status_code for my servertest01 in a custom timestamp range.

import rawes
from datetime import datetime
from dateutil import tz
paristimezone = tz.gettz('Europe/Paris')

es = rawes.Elastic('127.0.0.1:9200')

result = es.get('/_search', data={
    "query" : { "match_all" : {}
              },
    "filter": {
        "range": {
           "@timestamp": {
              "from": datetime(2013, 3, 11, 8, 0, 30,   tzinfo=paristimezone),
               "to": datetime(2013, 3, 12, 11, 0, 30, tzinfo=paristimezone)}
                  }
           },
   "facets" : {
       "error" : {
        "terms" : {
            "field" : "status_code"
        },
         "facet_filter" : {
            "term" : {"server" : "testserver01"}
           }
        }
    }
})

print(result['facets'])

And in my ES data, the timestamp field is like this:

"@timestamp":"2013-03-12T00:02:29+01:00"

Thanks :)

Upvotes: 3

Views: 7819

Answers (1)

DrTech
DrTech

Reputation: 17319

The filter element in the search API is used to filter query results AFTER facets have been calculated.

If you want to apply the filter both to the query and to the facets, then you should use a filtered query instead:

result = es.get('/_search', data={
    "query": {
        "filtered": {
            "query" : { "match_all" : {}},
            "filter": {
                "range": {
                   "@timestamp": {
                      "from": datetime(2013, 3, 11, 8, 0, 30,   tzinfo=paristimezone),
                       "to": datetime(2013, 3, 12, 11, 0, 30, tzinfo=paristimezone)
                    }
                }
            }
        }
    },           
   "facets" : {
       "error" : {
        "terms" : {
            "field" : "status_code"
        },
         "facet_filter" : {
            "term" : {"server" : "testserver01"}
           }
        }
    }
})

Upvotes: 4

Related Questions