CODEWITHSUNDEEP
elasticsearchelasticsearch-5
painbot
painbot

Reputation: 170

Elasticsearch query_string with date math

I'm trying to do a date range query with date math in Elasticsearch and it's not returning any results:

`query: {
    bool: {
        must: {
            query_string: {
                query: "created_at:[now-1m/d TO now/d+1d]", default_operator: "AND", analyzer: "my_text"}
            }
        }
    }
}`

Changing the query to include actual date does work: "created_at:[2017-07-25 TO 2017-08-25]"

I also tried a workaround by combining a query_string with a range query, but that didn't return any results either:

`query: {
    bool: {
        must: [
            {query_string: {query: "", default_operator: "AND", analyzer: "my_text"}}, 
            {range: {"created_at"=>{from: "now-1m/d", to: "now/d+1d"}}}]
        }
    }
}`

Use of date math does show the correct counts in aggs:

`aggs: {
    created_at: {
        date_range: {
            field: "created_at", keyed: true, ranges: [
                {from: "now/d", to: "now/d+1d", key: "Today"}, 
                {from: "now-1d/d", to: "now/d+1d", key: "In the last day"}, 
                {from: "now-7d/d", to: "now/d+1d", key: "In the last week"}, 
                {from: "now-1M/d", to: "now/d+1d", key: "In the last month"}
            ]
        }
    }
}`

Does date math work with Elasticsearch query_string query? And if not what is the right workaround?

Upvotes: 3

Views: 2355

Answers (1)

dshockley
dshockley

Reputation: 1494

I think you have a capitalization typo -- m should be M: [now-1M/d TO now/d+1d] (capitalization is correct in your last example, that's why it works there).

Upvotes: 2

Related Questions