CODEWITHSUNDEEP
elasticsearchgo
Matej
Matej

Reputation: 695

GoLang, elasticsearch multiple query parameters

I have a project in golang which fetches logs from elastiearch where our servers send logs. I have a problem with multiple query. I want to query by two fields, where both must be found and filter result to get all these logs between two timestamps. In the code below attaching deploymentName object into Filter()causes for no results at all. 

import  ("github.com/olivere/elastic")


func main() {

client, err := elastic.NewClient(elastic.SetURL(*elasticUrl))


   //query by time
    timeQ := elastic.NewRangeQuery("@timestamp").From(from).To(to)

   //query by key named "component"
    componentQ := elastic.NewMatchQuery("component", *component)

    //query by key named "deploymentName", sam type as component
    deploymentQ := elastic.NewMatchQuery("deploymentName", deploymentName)

    //query object used for actual search later
    generalQ := elastic.NewBoolQuery().Should().
       Filter(timeQ).Filter(componentQ).Filter(deploymentQ)

        searchResult, err := client.Search().
                Index("some-index").
                From(from).Size(*chunk).
                Query(generalQ).
                Sort("@timestamp", true).
                Do(context.Background())
}

While if generalQuery is written like this, it works.

        //query object used for actual search later
    generalQ := elastic.NewBoolQuery().Should().
       Filter(timeQ).Filter(componentQ)

Upvotes: 2

Views: 4878

Answers (1)

desnia
desnia

Reputation: 31

I am currently new with Elasticsearch, but this way actually works and return the specified components and deployments in a given time range.

timeQ := elastic.NewRangeQuery("@timestamp").From(from).To(End)
componentQ := elastic.NewTermQuery("component", *component)
deploymentQ := elastic.NewTermQuery("deploymentName", deploymentName)

generalQ := elastic.NewBoolQuery()
generalQ = generalQ.Must(timeQ).Must(componentQ).Must(deploymentQ)

Upvotes: 3

Related Questions