CODEWITHSUNDEEP
jsonelasticsearchlucene
Sepehr Sobhani
Sepehr Sobhani

Reputation: 882

Elasticsearch trying to query term and time range

I am trying to find all documents in which the content field contains the word "syria" and have the epoch time be greater than 1465312440000. The following query runs, but does only return the documents that contain word "syria". How do I fix this?(Elasticsearch version 2.2)

{
    "query": {
        "filtered": {
        "query": {
            "match": {
                "content": "syria"
            },
            "filter": {
                "term": {
                    "sourceOriginator": "Twitter"
                },
                "bool": {

                    "range": {
                        "epochCollectionDate": {
                            "gte": 1465312440

                        }
                    }
                }

            }

        }
    }
}
}

Upvotes: 0

Views: 617

Answers (3)

Karan
Karan

Reputation: 33

Thank you Guys. I struggled with this so if someone is looking for how to do this with aggregation as well, i used winlogbeat but it will work with other indexes just change terms and field names. I tested this with Elastic 7.1.1

{
  "size": 0,
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "winlog.event_id": "5156"
          }
        }
      ],
      "filter": [
        {
          "term": {
            "winlog.provider_name" : "Microsoft-Windows-Security-Auditing"
          }
        },
        {
          "range": {
            "@timestamp": {
                        "gt": "now-10d",
                        "lt": "now"
            }
          }
        }
      ]
    }
  },
    "aggregations": {
        "event_count": {
            "value_count": {
                "field": "winlog.event_id"
            }
        },
        "group_by_host": {
            "terms": {
                "field": "host.name",
                "size": 10,
                "min_doc_count": 1,
                "shard_min_doc_count": 0,
                "show_term_doc_count_error": false,
                "order": [
                    {
                        "_count": "desc"
                    },
                    {
                        "_key": "asc"
                    }
                ]
            }
        },

   }
}

Upvotes: 1

Val
Val

Reputation: 217304

Just to complement @Jettro's solution which will only work on ES 2.0 and later, the following one will work on all versions up to ES 5.

{
  "query": {
    "filtered": {
      "query": {
        "match": {
          "content": "syria"
        }
      },
      "filter": {
        "bool": {
          "must": [
            {
              "term": {
                "sourceOriginator": "Twitter"
              }
            },
            {
              "range": {
                "epochCollectionDate": {
                  "gte": 1465312440
                }
              }
            }
          ]
        }
      }
    }
  }
}

Note that if you are on ES 2.0 or later, you should really use @Jettro's solution as the filtered query has been deprecated in 2.0.

Upvotes: 0

Jettro Coenradie
Jettro Coenradie

Reputation: 4733

Of course it is hard to test without the data, but the filter is wrong. It should be on the same level as the second query. To my opinion the following solution is easier:

{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "content": "syria"
          }
        }
      ],
      "filter": [
        {
          "term": {
            "sourceOriginator": "Twitter"
          }
        },
        {
          "range": {
            "epochCollectionDate": {
              "gte": 1465312440
            }
          }
        }
      ]
    }
  }
}

Upvotes: 0

Related Questions