Date query

Elastic Stack Elasticsearch
1

Hi All,

I created an index with the field name Logtime with the value "2012-08-14
13:03:05,681". Now, I want to create a count query specifying the date
range on the specified Logtime field. I am running below query as below:
curl -XGET
'http://localhost:9200/txlog/_search?pretty=1&search_type=count' -d '
{
"query" : {
"range" : {
"LOGTIME" : {
"lt" : "2012-08-14 13:03:05,681"
"gt" : "2012-08-14 13:03:05,681"
}
}
}
}'
The result of above query is :
{
"took" : 4,
"timed_out" : false,
"_shards" : {
"total" : 5,
"successful" : 5,
"failed" : 0
},
"hits" : {
"total" : 0,
"max_score" : 0.0,
"hits" : [ ]
}
Mapping is as follows:
$ curl -XGET 'http://localhost:9200/txlog/_mapping'
{"txlog":{"transaction":{"properties":{"json":{"dynamic":"true","properties":{"API":{"type":"string"},"GLOBALID":{"type":"string"},"LOGTIME":{"type":"string"}}}}}}}

Even, if run the below command:
curl -XGET 'http://localhost:9200/txlog/_search?q=LOGTIME:"2012-08-14
13:03:06,441"'
it says: curl: (52) Empty reply from server
However, I can see the document with the specified logtime.

Is the stored logtime format is correct? Should I stored the logtime in
another format? I want to keep the second information as part of the
logtime. Please help...

Thanks
Ashutosh Sharma

--

2

I think it's better to use timestamp. Then you could simply use comparison operators.

3

Hi Ashutosh,

I think the reason why the range query isn't working is because the
LOGTIME field is of type string.
If you set the field LOGTIME to type date and use the correct date
format (be default UTC, but this can be changed)
then range queries should work. Take a look at the date type documentation:

Martijn

On 16 August 2012 11:38, Ashutosh Sharma ashu1979@gmail.com wrote:

Hi All,

I created an index with the field name Logtime with the value "2012-08-14
13:03:05,681". Now, I want to create a count query specifying the date range
on the specified Logtime field. I am running below query as below:
curl -XGET 'http://localhost:9200/txlog/_search?pretty=1&search_type=count'
-d '
{
"query" : {
"range" : {
"LOGTIME" : {
"lt" : "2012-08-14 13:03:05,681"
"gt" : "2012-08-14 13:03:05,681"
}
}
}
}'
The result of above query is :
{
"took" : 4,
"timed_out" : false,
"_shards" : {
"total" : 5,
"successful" : 5,
"failed" : 0
},
"hits" : {
"total" : 0,
"max_score" : 0.0,
"hits" :
}
Mapping is as follows:
$ curl -XGET 'http://localhost:9200/txlog/_mapping'
{"txlog":{"transaction":{"properties":{"json":{"dynamic":"true","properties":{"API":{"type":"string"},"GLOBALID":{"type":"string"},"LOGTIME":{"type":"string"}}}}}}}

Even, if run the below command:
curl -XGET 'http://localhost:9200/txlog/_search?q=LOGTIME:"2012-08-14
13:03:06,441"'
it says: curl: (52) Empty reply from server
However, I can see the document with the specified logtime.

Is the stored logtime format is correct? Should I stored the logtime in
another format? I want to keep the second information as part of the
logtime. Please help...

Thanks
Ashutosh Sharma

--

--
Met vriendelijke groet,

Martijn van Groningen

--