CODEWITHSUNDEEP
elasticsearch
Fabry
Fabry

Reputation: 1650

Elasticsearch api combine range and tags

I have 2 elk working queries:

GET _search
{
  "query": {
    "range":{
      "timestamp":{
        "gt": "now-15m"
      }
    }
  }
}

and 

GET _search
{
  "query": {
    "bool" : {
      "must" : {
        "match" : { "tags" : "mytag" }
      }
    }
  }
}

How can I combine this 2 queries? Basically I want to retrieve all the documents in the last 15 minutes with a tag equals to 'mytag'

Upvotes: 0

Views: 30

Answers (1)

Green
Green

Reputation: 2565

You need to combine both of them using must and filter. When the first give you the tags which you need and the second filter to the given time range. (BTW I went on with your schema but I remember you should look timestamp with @timestamp)

GET _search
{
  "query": {
    "bool" : {
      "must" : {
        "match" : { "tags" : "mytag" }
      },
     "filter": 
        {
          "range": {
            "timestamp": {
               "gt": "now-15m"
            }
          }
        }
    }
  }
}

Upvotes: 1

Related Questions