Add filter range in request


(Sergey) #1

Hi!!!
I have a request:

{
"size": 10000, 
"filter": {
"term": {
"user_id": "254337"
}
},
"query": {
"bool": {
"should" : [
{
 "term" : { "event" : "logged_in" }
},
{
"term" : { "event" : "deauthorize" }
}
],
"minimum_number_should_match": 1
}
},
"sort": [
 {
 "@timestamp": {
 "order": "asc"
 }
 }
] 
}

And I need to add range filter to my request:

"filter": 
{
"range": {
"@timestamp": {
"gt": "now-1h"
}
}
}

where i can put it?


(Mark Harwood) #2

Multiple filters to queries can be arranged with a must clause like this:

GET test/doc/_search
{
   "size": 10000,
   "query": {
	  "filtered": {
		 "query": {
			"bool": {
			   "should": [
				  {
					 "term": {
						"event": "logged_in"
					 }
				  },
				  {
					 "term": {
						"event": "deauthorize"
					 }
				  }
			   ],
			   "minimum_number_should_match": 1
			}
		 },
		 "filter": {
			"bool": {
			   "must": [
				  {
					 "range": {
						"@timestamp": {
						   "gt": "now-1h"
						}
					 }
				  },
				  {
					 "term": {
						"user_id": "254337"
					 }
				  }
			   ]
			}
		 }
	  }
   },
   "sort": [
	  {
		 "@timestamp": {
			"order": "asc"
		 }
	  }
   ]
}

(Sergey) #3

THX it works!!!


(system) #4