Elastic search query group only data where none of the fields contain x

(Tomaz Bratanic) #1

The structure of my logs looks like this:

{deviceID:"xx", charger:"xy", date: "yy", battery: 5}

Is it possible to have a ES query that.

  1. Takes last 24h
  2. Excludes devices where any of the log in the last 24h had charger value = 2
  3. Returns logs

I don't know how to do the second step where you exclude all the logs from a single device if any of the logs had a specific value.


(Jaspreet Singh) #2

I would try ...

  "query": {
    "bool": {
      "filter": {
              "range": {
                "date": {
                  "gte": "now-1d",
                  "lte": "now"
      "must_not": [
          "match": {
            "charger": "2"

Alternatively, you can combine filter for charge field if it is non-analyzed and you dont want to score it, helps with caching too, along with range filter.

(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.