# Elasticsearch query time range issue

**URL:** <https://discuss.elastic.co/t/elasticsearch-query-time-range-issue/268672>\
**Category:** Elasticsearch\
**Created:** [March 29, 2021, 3:19pm UTC](https://discuss.elastic.co/t/elasticsearch-query-time-range-issue/268672 "2021-03-29T15:19:07Z")\
**Posts on this page:** 12\
**Page:** 3

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [April 8, 2021, 9:25am UTC](https://discuss.elastic.co/t/elasticsearch-query-time-range-issue/268672/42 "2021-04-08T09:25:26Z")

</div>

Could start again from the beginning? When there is no `pit` yet?

Something like:

```auto
POST /INDEXNAME/_pit?keep_alive=5m

```

And then share here the request AND the response.

Then run:

```auto
POST /_search 
{
   "size":1,
   "_source":[
      "kubernetes.container.name",
      "kubernetes.namespace",
      "message",
      "@timestamp"
   ],
   "query":{
      "bool":{
         "must":{
            "match":{
               "message":"exception"
            }
         },
         "filter":{
            "range":{
               "@timestamp":{
                  "gte":"2021-04-06T01:00:00",
                  "lte":"2021-04-06T18:00:00"
               }
            }
         }
      }
   },
   "pit":{
      "id":"PIT_ID_THAT_YOU_GOT",
      "keep_alive":"5m"
   },
   "sort":[
      {
         "@timestamp":"asc"
      }
   ]
}

```

And share here the request AND the result. Note that I set `size: 1` so the result will be small enough to be pasted here.

---

<div class="post-metadata">

**Author:** ![suresh123](https://avatars.discourse-cdn.com/v4/letter/s/cdc98d/32.png) [@suresh123](https://discuss.elastic.co/u/suresh123)\
**Post date:** [April 8, 2021, 9:53am UTC](https://discuss.elastic.co/t/elasticsearch-query-time-range-issue/268672/43 "2021-04-08T09:53:37Z")

</div>

Hi David,

PIT ID  
{"id":"48myAwcaZGV2Mi1hcHBsb2dzLWJlLTIwMjEuMDQuMDgWY1d0MzhzSERRZnF6eGNNLVJubko0QQAWWWNmSml6aVdRR21yNFJpTWZ5U3FCdwAAAAAAAA0paBZveVVmVFRUM1JwVzFOcXpvSF9ITW5BABpkZXYyLWFwcGxvZ3MtYmUtMjAyMS4wNC4wNRZqWlAyYXdwSVRTS1hqRUh4bGI2Uk93ABZjUDZQYl9zcVJsQ0h1Sk5JS2RaRERnAAAAAAAAAmldFm9Ec1FORjQyUXZpam5VYTB4ekh2Y3cAGmRldjItYXBwbG9ncy1iZS0yMDIxLjA0LjA3FmFEQWotRURYU2pHbjVBdm1mTWtSNGcAFlljZkppemlXUUdtcjRSaU1meVNxQncAAAAAAAANKVwWb3lVZlRUVDNScFcxTnF6b0hfSE1uQQAaZGV2Mi1hcHBsb2dzLWJlLTIwMjEuMDQuMDIWTmNudXJCdS1UMldVQWtHcnhyR3NDZwAWY1A2UGJfc3FSbENIdUpOSUtkWkREZwAAAAAAAAJpXBZvRHNRTkY0MlF2aWpuVWEweHpIdmN3ABpkZXYyLWFwcGxvZ3MtYmUtMjAyMS4wNC4wNhZDUGRfUF9RMVJEdVMxYmpLNlViSWJBABZFamdFTTBoaFIyV0RzMF9DbkcycFFRAAAAAAAAAe06FnVVazE1dXRWVDJDTmdKWFUtekNRMmcAGmRldjItYXBwbG9ncy1iZS0yMDIxLjA0LjA0FkRNUUpHd1l3VHlLbjVJM0JOSlZRSGcAFkVqZ0VNMGhoUjJXRHMwX0NuRzJwUVEAAAAAAAAB7TkWdVVrMTV1dFZUMkNOZ0pYVS16Q1EyZwAaZGV2Mi1hcHBsb2dzLWJlLTIwMjEuMDQuMDMWZlhWT2FjR3hRRktFSDlhekNZNlBZQQAWRWpnRU0waGhSMldEczBfQ25HMnBRUQAAAAAAAAHtOBZ1VWsxNXV0VlQyQ05nSlhVLXpDUTJnAAcWRE1RSkd3WXdUeUtuNUkzQk5KVlFIZwAAFmNXdDM4c0hEUWZxenhjTS1Sbm5KNEEAABZmWFZPYWNHeFFGS0VIOWF6Q1k2UFlBAAAWQ1BkX1BfUTFSRHVTMWJqSzZVYkliQQAAFmFEQWotRURYU2pHbjVBdm1mTWtSNGcAABZqWlAyYXdwSVRTS1hqRUh4bGI2Uk93AAAWTmNudXJCdS1UMldVQWtHcnhyR3NDZwAA"}

Still same error

"root\_cause" : [  
{  
"type" : "search\_context\_missing\_exception",  
"reason" : "No search context found for id [158044]"  
},

```auto
POST /_search 
{
   "size":1,
   "_source":[
      "kubernetes.container.name",
      "kubernetes.namespace",
      "message",
      "@timestamp"
   ],
   "query":{
      "bool":{
         "must":{
            "match":{
               "message":"exception"
            }
         },
         "filter":{
            "range":{
               "@timestamp":{
                  "gte":"2021-04-06T01:00:00",
                  "lte":"2021-04-06T18:00:00"
               }
            }
         }
      }
   },
   "pit":{
      "id":"48myAwcaZGV2Mi1hcHBsb2dzLWJlLTIwMjEuMDQuMDgWY1d0MzhzSERRZnF6eGNNLVJubko0QQAWWWNmSml6aVdRR21yNFJpTWZ5U3FCdwAAAAAAAA0paBZveVVmVFRUM1JwVzFOcXpvSF9ITW5BABpkZXYyLWFwcGxvZ3MtYmUtMjAyMS4wNC4wNRZqWlAyYXdwSVRTS1hqRUh4bGI2Uk93ABZjUDZQYl9zcVJsQ0h1Sk5JS2RaRERnAAAAAAAAAmldFm9Ec1FORjQyUXZpam5VYTB4ekh2Y3cAGmRldjItYXBwbG9ncy1iZS0yMDIxLjA0LjA3FmFEQWotRURYU2pHbjVBdm1mTWtSNGcAFlljZkppemlXUUdtcjRSaU1meVNxQncAAAAAAAANKVwWb3lVZlRUVDNScFcxTnF6b0hfSE1uQQAaZGV2Mi1hcHBsb2dzLWJlLTIwMjEuMDQuMDIWTmNudXJCdS1UMldVQWtHcnhyR3NDZwAWY1A2UGJfc3FSbENIdUpOSUtkWkREZwAAAAAAAAJpXBZvRHNRTkY0MlF2aWpuVWEweHpIdmN3ABpkZXYyLWFwcGxvZ3MtYmUtMjAyMS4wNC4wNhZDUGRfUF9RMVJEdVMxYmpLNlViSWJBABZFamdFTTBoaFIyV0RzMF9DbkcycFFRAAAAAAAAAe06FnVVazE1dXRWVDJDTmdKWFUtekNRMmcAGmRldjItYXBwbG9ncy1iZS0yMDIxLjA0LjA0FkRNUUpHd1l3VHlLbjVJM0JOSlZRSGcAFkVqZ0VNMGhoUjJXRHMwX0NuRzJwUVEAAAAAAAAB7TkWdVVrMTV1dFZUMkNOZ0pYVS16Q1EyZwAaZGV2Mi1hcHBsb2dzLWJlLTIwMjEuMDQuMDMWZlhWT2FjR3hRRktFSDlhekNZNlBZQQAWRWpnRU0waGhSMldEczBfQ25HMnBRUQAAAAAAAAHtOBZ1VWsxNXV0VlQyQ05nSlhVLXpDUTJnAAcWRE1RSkd3WXdUeUtuNUkzQk5KVlFIZwAAFmNXdDM4c0hEUWZxenhjTS1Sbm5KNEEAABZmWFZPYWNHeFFGS0VIOWF6Q1k2UFlBAAAWQ1BkX1BfUTFSRHVTMWJqSzZVYkliQQAAFmFEQWotRURYU2pHbjVBdm1mTWtSNGcAABZqWlAyYXdwSVRTS1hqRUh4bGI2Uk93AAAWTmNudXJCdS1UMldVQWtHcnhyR3NDZwAA",
      "keep_alive":"5m"
   },
   "sort":[
      {
         "@timestamp":"asc"
      }
   ]
}

```

---

<div class="post-metadata">

**Author:** ![suresh123](https://avatars.discourse-cdn.com/v4/letter/s/cdc98d/32.png) [@suresh123](https://discuss.elastic.co/u/suresh123)\
**Post date:** [April 8, 2021, 10:07am UTC](https://discuss.elastic.co/t/elasticsearch-query-time-range-issue/268672/44 "2021-04-08T10:07:20Z")

</div>

I executed same thing in devtools, working fine.

I need to do same thing in server.

{  
"pit\_id" : "48myAwcaZGV2Mi1hcHBsb2dzLWJlLTIwMjEuMDQuMDgWY1d0MzhzSERRZnF6eGNNLVJubko0QQAWWWNmSml6aVdRR21yNFJpTWZ5U3FCdwAAAAAAAA01GxZveVVmVFRUM1JwVzFOcXpvSF9ITW5BABpkZXYyLWFwcGxvZ3MtYmUtMjAyMS4wNC4wNRZqWlAyYXdwSVRTS1hqRUh4bGI2Uk93ABZZY2ZKaXppV1FHbXI0UmlNZnlTcUJ3AAAAAAAADTUZFm95VWZUVFQzUnBXMU5xem9IX0hNbkEAGmRldjItYXBwbG9ncy1iZS0yMDIxLjA0LjA3FmFEQWotRURYU2pHbjVBdm1mTWtSNGcAFmNQNlBiX3NxUmxDSHVKTklLZFpERGcAAAAAAAACcvcWb0RzUU5GNDJRdmlqblVhMHh6SHZjdwAaZGV2Mi1hcHBsb2dzLWJlLTIwMjEuMDQuMDIWTmNudXJCdS1UMldVQWtHcnhyR3NDZwAWWWNmSml6aVdRR21yNFJpTWZ5U3FCdwAAAAAAAA01GBZveVVmVFRUM1JwVzFOcXpvSF9ITW5BABpkZXYyLWFwcGxvZ3MtYmUtMjAyMS4wNC4wNhZDUGRfUF9RMVJEdVMxYmpLNlViSWJBABZjUDZQYl9zcVJsQ0h1Sk5JS2RaRERnAAAAAAAAAnL2Fm9Ec1FORjQyUXZpam5VYTB4ekh2Y3cAGmRldjItYXBwbG9ncy1iZS0yMDIxLjA0LjA0FkRNUUpHd1l3VHlLbjVJM0JOSlZRSGcAFkVqZ0VNMGhoUjJXRHMwX0NuRzJwUVEAAAAAAAAB8GkWdVVrMTV1dFZUMkNOZ0pYVS16Q1EyZwAaZGV2Mi1hcHBsb2dzLWJlLTIwMjEuMDQuMDMWZlhWT2FjR3hRRktFSDlhekNZNlBZQQAWRWpnRU0waGhSMldEczBfQ25HMnBRUQAAAAAAAAHwaBZ1VWsxNXV0VlQyQ05nSlhVLXpDUTJnAAcWRE1RSkd3WXdUeUtuNUkzQk5KVlFIZwAAFmNXdDM4c0hEUWZxenhjTS1Sbm5KNEEAABZmWFZPYWNHeFFGS0VIOWF6Q1k2UFlBAAAWQ1BkX1BfUTFSRHVTMWJqSzZVYkliQQAAFmFEQWotRURYU2pHbjVBdm1mTWtSNGcAABZqWlAyYXdwSVRTS1hqRUh4bGI2Uk93AAAWTmNudXJCdS1UMldVQWtHcnhyR3NDZwAA",  
"took" : 54,  
"timed\_out" : false,  
"\_shards" : {  
"total" : 7,  
"successful" : 7,  
"skipped" : 6,  
"failed" : 0  
},  
"hits" : {  
"total" : {  
"value" : 88,  
"relation" : "eq"  
},  
"max\_score" : null,  
"hits" : [  
{  
"\_index" : "dev2-applogs-be-2021.04.06",  
"\_type" : "\_doc",  
"\_id" : "GZrJpXgBm5biRIvY8df6",  
"\_score" : null,  
"\_source" : {  
"kubernetes" : {  
"container" : {  
"name" : "hp-wcc-services-search"  
},  
"namespace" : "dev2"  
},  
"@timestamp" : "2021-04-06T06:06:11.335Z",  
"message" : """2021-04-06 06:06:11.332 WARN [search-service,,,] Check result of the [AsyncReporter{org.springframework.cloud.sleuth.zipkin2.sender.RestTemplateSender@41be8db9}] contains an error [CheckResult{ok=false, error=org.springframework.web.client.ResourceAccessException: I/O error on POST request for "[http://wcc-monitor.corp.hpicloud.net:9411/api/v2/spans](http://wcc-monitor.corp.hpicloud.net:9411/api/v2/spans)": connect timed out; nested exception is java.net.SocketTimeoutException: connect timed out}]"""  
},  
"sort" : [  
1617689171335,  
48550  
]  
}  
]  
}  
}

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [April 8, 2021, 10:22am UTC](https://discuss.elastic.co/t/elasticsearch-query-time-range-issue/268672/45 "2021-04-08T10:22:02Z")

</div>

Please read again:

> [@dadoonet](#):
>
> Something like:
> 
> Copy to clipboard
> 
> ```auto
> POST /INDEXNAME/_pit?keep_alive=5m
> 
> ```
> 
> And then share here **the request AND** the response.

And:

> [@dadoonet](#):
>
> Stop formatting as code the text part. Please format only the code part.
> 
> Is there anything you don't understand in this sentence that I need to clarify?

Please format **ALL** the code parts as you did for only the last part of the code in this answer [Elasticsearch query time range issue - #43 by suresh123](https://discuss.elastic.co/t/elasticsearch-query-time-range-issue/268672/43).

---

<div class="post-metadata">

**Author:** ![suresh123](https://avatars.discourse-cdn.com/v4/letter/s/cdc98d/32.png) [@suresh123](https://discuss.elastic.co/u/suresh123)\
**Post date:** [April 8, 2021, 10:23am UTC](https://discuss.elastic.co/t/elasticsearch-query-time-range-issue/268672/46 "2021-04-08T10:23:38Z")

</div>

Hi David,

It woks perfectly. Let me get more then 1 lakh count.

Thanks

---

<div class="post-metadata">

**Author:** ![suresh123](https://avatars.discourse-cdn.com/v4/letter/s/cdc98d/32.png) [@suresh123](https://discuss.elastic.co/u/suresh123)\
**Post date:** [April 8, 2021, 11:01am UTC](https://discuss.elastic.co/t/elasticsearch-query-time-range-issue/268672/47 "2021-04-08T11:01:36Z")

</div>

Hi David,

I am getting sort for every request

"sort" : [  
1617731997062,  
223299  
]

So, which sort numbers I need to add in search\_after ?  
"search\_after": [  
4098435132000,  
4294967298  
],

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [April 8, 2021, 11:26am UTC](https://discuss.elastic.co/t/elasticsearch-query-time-range-issue/268672/48 "2021-04-08T11:26:08Z")

</div>

Both I guess.

---

<div class="post-metadata">

**Author:** ![suresh123](https://avatars.discourse-cdn.com/v4/letter/s/cdc98d/32.png) [@suresh123](https://discuss.elastic.co/u/suresh123)\
**Post date:** [April 8, 2021, 11:35am UTC](https://discuss.elastic.co/t/elasticsearch-query-time-range-issue/268672/49 "2021-04-08T11:35:22Z")

</div>

There are thousands of sorts, which sort numbers i need to give exactly  
Example

```auto
{
        "_index" : "dev-nginx-logs-2021.04.08",
        "_type" : "_doc",
        "_id" : "ROTPrngBm5biRIvY1qF3",
        "_score" : null,
        "_source" : {
          "request" : "image1",
          "referrer" : "-",
          "response_code" : 404,
          "@timestamp" : "2021-04-08T00:09:19.193Z"
        },
        "sort" : [
          1617840559193,
          4294968280
        ]
      },
      {
        "_index" : "dev-nginx-logs-2021.04.08",
        "_type" : "_doc",
        "_id" : "KuvPrngB9h4iHZ0t9DoD",
        "_score" : null,
        "_source" : {
          "request" : "/images/windows_image",
          "referrer" : "-",
          "response_code" : 404,
          "@timestamp" : "2021-04-08T00:09:26.194Z"
        },
        "sort" : [
          1617840566194,
          4294968281
        ]
      },

```

This is the search\_after which sort I need to give.  
"search\_after": [  
4098435132000,  
4294967298  
],

---

<div class="post-metadata">

**Author:** ![suresh123](https://avatars.discourse-cdn.com/v4/letter/s/cdc98d/32.png) [@suresh123](https://discuss.elastic.co/u/suresh123)\
**Post date:** [April 8, 2021, 12:17pm UTC](https://discuss.elastic.co/t/elasticsearch-query-time-range-issue/268672/50 "2021-04-08T12:17:00Z")

</div>

Hi David,

I took last value as it is giving Ascending order.

Thanks

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [April 8, 2021, 12:27pm UTC](https://discuss.elastic.co/t/elasticsearch-query-time-range-issue/268672/51 "2021-04-08T12:27:55Z")

</div>

I think everything is good. So we can close this long thread now.

Feel free to open a new question if needed.

---

<div class="post-metadata">

**Author:** ![suresh123](https://avatars.discourse-cdn.com/v4/letter/s/cdc98d/32.png) [@suresh123](https://discuss.elastic.co/u/suresh123)\
**Post date:** [April 8, 2021, 12:41pm UTC](https://discuss.elastic.co/t/elasticsearch-query-time-range-issue/268672/52 "2021-04-08T12:41:54Z")

</div>

Thanks you somuch.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 6, 2021, 12:42pm UTC](https://discuss.elastic.co/t/elasticsearch-query-time-range-issue/268672/53 "2021-05-06T12:42:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/elasticsearch-query-time-range-issue/268672.md?page=2)