DSL Query does date math differently than KQL?

Elastic Stack Elasticsearch
1

I have a Kibana graph showing a number of records where a value is >= the current date (specifically now/d). I just happened to be testing a similar query in dev tools when I discovered that the number shown in Kibana or in the Discover search is off by a couple hundred from what the query shows. After lots of experimenting, I've determined that the only thing impacting the return count is the /d in the date math. How are they calculating dates differently?

This Query:

GET my-index/_search
{
  "size": 0,
  "track_total_hits": true, 
  "query": {
    "bool": {
      "must": [
        {
          "range": {
            "expiresAt": {
              "gte": "now/d"
            }
          }
        }
      ]
    }
  }
}

Returns this result:

{
  "took": 2,
  "timed_out": false,
  "_shards": {
    "total": 1,
    "successful": 1,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": {
      "value": 64215,
      "relation": "eq"
    },
    "max_score": null,
    "hits": []
  }
}

However, in Discover, I find that the exact same query returns only 64075 hits.
image

2

Hello @pocketcolin,

This could be due to some rounding difference in the value of 'now/d'.

  • You can consider adding the "time_zone" parameter to your query. This parameter does not affect the date math value of 'now'; 'now' always represents the current system time in UTC. However, it will convert the value of 'now/d'.

  • You can consider specifying the exact date for the nearest day in your query.

  • Or, if your goal is to fetch data through the Kibana Discover query bar using KQL, you can use the same Query DSL you are currently using. In Kibana Discover, you can add a filter by clicking '+ Add Filter' and then selecting 'Edit as Query DSL'.

Hope it helps!

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.