Create request for last 15 min

Elastic Stack Elasticsearch
1

Hi community!!!
I want to create a request that transmits me all the documents for last 15min.
Any advice will be highly appreciated!!!

1 Like
2

The easiest way would be to do a date range query.

3

@warkolm
Thanks, but how can i ask elasticsearch to do this.
I have my documents like this:
curl -XPUT localhost:9200/indexname/documentname/4 -d'
{

user: "sergey",
onlineUserCount: "43"
}'
i want to display all the documents that comes to elasticsearch for the last 15 minutes.

4

I've searched like this
$ curl -XGET localhost:9200/indexname/documentname/_query -d'{

"query":{
"range":{
"timestamp":{
"gt": "now -15m"
}}}}'

But It gaves me nothing!!!

5

You need to use the _search endpoint in your request, not the _query endpoint.

6

@dantuff
Thx for reply. Is it possible to get what i want without timestamp?

7

Or i have to enabled timestamp if i want to request all documents for last 15 minutes?

8

Yes, take a look here:

https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-timestamp-field.html

9

I can't understand, Is elasticsearch create date field automatically or not? If it does how can i add the range without timestamp?

10

If you enable the _timestamp it will create the field. Here's a simple example. Create your index with _timestamp enabled.

POST /demo
{
	"mappings": {
		"_default_": {
			"_timestamp": {
				"enabled": true
			}
		}
	}
}

Index a document:

POST /demo/doc/1
{
    "name": "test"
}

Now execute the range query and the document is returned

POST /demo/_search
{
	"query": {
		"range": {
			"_timestamp": {
				"gt": "now-15m"
			}
		}
	}
}
1 Like