How to fetch all Elastic Search docs which satisfies a logical criteria?

Question

Consider this doc -

 {
    "took": 7,
    "timed_out": false,
    "_shards": {
        "total": 5,
        "successful": 5,
        "skipped": 0,
        "failed": 0
    },
    "hits": {
        "total": 9,
        "max_score": 1.0,
        "hits": [
            {
                "_index": "test_index",
                "_type": "test",
                "_id": "5",
                "_score": 1.0,
                "_source": {
                    "lastStateUpdateDate": "2021-05-14",
                    "lastUpdateStateType": "lead_few",
                    "lead_name": "abcdefg"
                }
            },
            {
                "_index": "test_index",
                "_type": "test",
                "_id": "8",
                "_score": 1.0,
                "_source": {
                    "lastStateUpdateDate": "2022-03-14",
                    "lastUpdateStateType": "lead_few",
                    "lead_name": "abcdefghij"
                }
            },
            {
                "_index": "test_index",
                "_type": "test",
                "_id": "9",
                "_score": 1.0,
                "_source": {
                    "lastStateUpdateDate": "2022-03-14",
                    "lastUpdateStateType": "lead_gew",
                    "lead_name": "abcdefghijk"
                }
            },
            {
                "_index": "test_index",
                "_type": "test",
                "_id": "2",
                "_score": 1.0,
                "_source": {
                    "lastStateUpdateDate": "2022-01-14",
                    "lastUpdateStateType": "lead_few",
                    "lead_name": "abcd"
                }
            },
            {
                "_index": "test_index",
                "_type": "test",
                "_id": "4",
                "_score": 1.0,
                "_source": {
                    "lastStateUpdateDate": "2021-05-14",
                    "lastUpdateStateType": "lead_new",
                    "lead_name": "abcdef"
                }
            },
            {
                "_index": "test_index",
                "_type": "test",
                "_id": "6",
                "_score": 1.0,
                "_source": {
                    "lastStateUpdateDate": "2021-05-14",
                    "lastUpdateStateType": "lead_gew",
                    "lead_name": "abcdefgh"
                }
            },
            {
                "_index": "test_index",
                "_type": "test",
                "_id": "1",
                "_score": 1.0,
                "_source": {
                    "lastStateUpdateDate": "2022-01-14",
                    "lastUpdateStateType": "lead_new",
                    "lead_name": "abc"
                }
            },
            {
                "_index": "test_index",
                "_type": "test",
                "_id": "7",
                "_score": 1.0,
                "_source": {
                    "lastStateUpdateDate": "2022-03-14",
                    "lastUpdateStateType": "lead_new",
                    "lead_name": "abcdefghi"
                }
            },
            {
                "_index": "test_index",
                "_type": "test",
                "_id": "3",
                "_score": 1.0,
                "_source": {
                    "lastStateUpdateDate": "2022-01-14",
                    "lastUpdateStateType": "lead_gew",
                    "lead_name": "abcde"
                }
            }
        ]
    }
}

I need all the docs which satisfies this criteria -

currentDate - lastStateUpdateDate > 30 (days)

Here match query or filter query will not evaluate this expression, i think we will be needing to write an if condition to fetch this, i could not find much information over ES scripting, mostly i found scripting inside aggregation, but i don't think aggregation is needed here.

How can i do it, can someone please help ?

Answer 1

You can do something very simple with date math in range queries:

{
  "query": {
    "range": {
      "lastStateUpdateDate": {
        "lt": "now-30d"
      }
    }
  }
}

The above query basically says: give me all documents whose lastStateUpdateDate is older than 30 days from now.