How do I limit an ElasticSearch API count by date?

Question

I'm trying to count the number of query matches over a given time range, hitting the URL /{index}/_count with the body indicated below.

I'm new to Query DSL, so it's quite possible I'm overlooking something obvious. However, the straightforward application of a count to an existing query doesn't work. I don't see anything in the docs that indicate a count query should receive special treatment.

I've tried adding a range and aggregations to the query, but I keep getting the following error or some variant:

indices:data/read/count[s]]]; nested: QueryParsingException[[graylog2_NN] request does not support [{label}]]

Limit query by timestamp:

{                                                                                                                                                                                 
    "query": {                                                                                                                                                                              
        "term": { "level":3 },                                                                                                                                                              
        "range": {                                                                                                                                                                          
            "timestamp": {                                                                                                                                                                  
                "from": "2015-06-16 15:10:09.322",                                                                                                                                          
                "to": "2015-06-16 16:10:09.322",                                                                                                                                            
                "include_lower": true,                                                                                                                                                      
                "include_upper": true                                                                                                                                                       
            }                                                                                                                                                                               
        }                                                                                                                                                                                   
    }                                                                                                                                                                                       
}

Use an aggregation:

{                                                                                                                                                                                 
    "query": {                                                                                                                                                                              
        "term": { "level":3 }                                                                                                                                                               
    },                                                                                                                                                                                      
    "aggs": {                                                                                                                                                                       
        "range": {                                                                                                                                                                          
            "date_range": {                                                                                                                                                                 
                field: "_timestamp",                                                                                                                                                        
                "ranges": {                                                                                                                                                                 
                    { "to": "now-1d" },                                                                                                                                                     
                    { "from": "now-2d" },                                                                                                                                                   
                }                                                                                                                                                                           
            }                                                                                                                                                                               
        }                                                                                                                                                                                   
    }                                                                                                                                                                                       
}

I've also tried plugging in the query exported from the UI (bug icon on an individual stream display), no joy there either (one hour's worth of matches):

{
    "from": 0,
    "size": 100,
    "query": {
        "match_all": {}
    },
    "post_filter": {
        "bool": {
            "must": [
                {
                    "range": {
                        "timestamp": {
                            "from": "2015-06-16 15:10:09.322",
                            "to": "2015-06-16 16:10:09.322",
                            "include_lower": true,
                            "include_upper": true
                        }
                    }
                },
                {
                    "query": {
                        "query_string": {
                            "query": "streams:5568c9dbe4b0b31b781bf105"
                        }
                    }
                }
            ]
        }
    },
    "sort": [
        {
            "timestamp": {
                "order": "desc"
            }
        }
    ],
    "highlight": {
        "require_field_match": false,
        "fields": {
            "*": {
                "fragment_size": 0,
                "number_of_fragments": 0
            }
        }
    }
}

Answer 1

Try the following query that uses bool query. I use a different timestamp format, which is the default in elasticsearch. Try that format first, if no luck modify the timestamp format to match yours.

{
    "query": {
        "bool" : {
            "should" : [
                {
                    "term": { "level":3 }
                },
                {
                    "range": {
                        "timestamp": {
                            "from": "2015-06-16T15:10:09",
                            "to": "2015-06-16T16:10:09"
                        }
                    }
                }
            ]
        }
    }
}

Answer 2

I've found a query that both matches and lines up pretty closely with numbers I get from the UI ("Search in the last 1 day"):

{                                                                                                                                                                                 
    "query": {                                                                                                                                                                              
        "filtered": {                                                                                                                                                                       
            "query": {                                                                                                                                                                      
                "term": { "level":3 }                                                                                                                                                       
            },                                                                                                                                                                              
            "filter": {                                                                                                                                                                     
                "range": { "timestamp": { "gte": "now-1d" } }                                                                                                                               
            }                                                                                                                                                                               
        }                                                                                                                                                                                   
    }                                                                                                                                                                                       
}