CODEWITHSUNDEEP
elasticsearchlucenekibana
Ed Baker
Ed Baker

Reputation: 663

Kibana Lucene Date Range

I know this can be done as a filter, but for 'reasons' I need to execute this as a Lucene query.

I have an field called "FileLoadedToElasticDateTime" and I'm trying to find any records for this year, so far I get zero results.

I have tried:

FileLoadedToElasticDateTime:[2018-01-01 TO 2018-12-31]
FileLoadedToElasticDateTime:[20180101 TO 20181231]
FileLoadedToElasticDateTime:[2018-01-01T00:00:00 TO 2018-12-31T18:00:00] 
FileLoadedToElasticDateTime:[2018-01-01 00:00:00 TO 2018-12-31 18:00:00] <-- Error

Here is a document view of the field:

enter image description here

The ES Mapping format is yyyy-MM-dd hh:mm:ss, I'm unsure if the kibana format is screwing with me?

Any help would be hugely appreciated.

Here's the error for where I'm attempting to use the time format as well

Error: Request to Elasticsearch failed: {"error":{"root_cause":[{"type":"query_shard_exception","reason":"Failed to parse query [FileLoadedToElasticDateTime:[2018-01-01 00:00:00 TO 2018-12-31 18:00:00]]","index_uuid":"HRAubcpVQM2Zk2oUVqN7Ng","index":"analytical"}],"type":"search_phase_execution_exception","reason":"all shards failed","phase":"query","grouped":true,"failed_shards":[{"shard":0,"index":"analytical","node":"Rb3ZRLUYTk-WmEEUOh4tdQ","reason":{"type":"query_shard_exception","reason":"Failed to parse query [FileLoadedToElasticDateTime:[2018-01-01 00:00:00 TO 2018-12-31 18:00:00]]","index_uuid":"HRAubcpVQM2Zk2oUVqN7Ng","index":"analytical","caused_by":{"type":"parse_exception","reason":"Cannot parse 'FileLoadedToElasticDateTime:[2018-01-01 00:00:00 TO 2018-12-31 18:00:00]': Encountered \" <RANGE_GOOP> \"00:00:00 \"\" at line 1, column 40.\nWas expecting:\n    \"TO\" ...\n    ","caused_by":{"type":"parse_exception","reason":"Encountered \" <RANGE_GOOP> \"00:00:00 \"\" at line 1, column 40.\nWas expecting:\n    \"TO\" ...\n    "}}}}]},"status":400}

I've tried wrapping the date in quotes and that doesn't work either.

I don't get errors with the other queries, just zero results

Upvotes: 1

Views: 11546

Answers (2)

rupson
rupson

Reputation: 51

I just ran into this issue as well.

If you don't care about the time:

MyDate:[2022-01-01 TO 2022-02-01]

But if you do care about the time, you have to wrap each date in quotes:

MyDate:["2022-01-01T00:00:00.000Z" TO "2022-02-02T00:00:00.000Z"]

Upvotes: 3

Mysterion
Mysterion

Reputation: 9320

You need to place T symbol between date and time part.

Something like this:

FileLoadedToElasticDateTime:[2018-01-01T00:00:00 TO 2018-12-31T18:00:00]

More information on date format - https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-date-format.html

Upvotes: 2

Related Questions