ES 5.2.1 : Date math range query unexpected result

Elastic Stack Elasticsearch
1

Hi,

I'm currently playing with ES 5.2.1 on my local machine.
And I fail to understand some of the results that I'm getting from a range query that uses date math.

I created a small index with the following mapping:

"properties": {
   "signupDate": {
      "type": "date",
      "format": "epoch_millis"
   },
   "str": {
      "type": "text",
      "analyzer": "lowercase_keyword"
   }
}

Currently I have just a single document in the Index with a signupDate of: Mon Apr 03 2017 16:07:14
I have been executing the following queries against the index:

POST myindex/_search
{
"query": {
"range": {
"signupDate": {
"gt": "now-3d"
}
}
}
}
POST myindex/_search
{
"query": {
"range": {
"signupDate": {
"gt": "now-3d/d"
}
}
}
}

While the first query was able to find the document (as it should), the second one wasn't able to find it, and I had to change the query to now-4d/d to find the document.

It is stated that /d round down to the nearest day. So I believe that every document that will be found by the first query must be found by the second query as well.

I used link in order to test the values that are returned from date math. It seems that the returned values are correct:

GET <logstash-{now-3d/d{YYYY.MM.dd.HH.mm.ss}}>/_search is looking for index: logstash-2017.04.03.00.00.00
GET <logstash-{now-3d{YYYY.MM.dd.HH.mm.ss}}>/_search is looking for index: logstash-2017.04.03.11.22.44

If I take those values and place them in the original queries with "format": "yyyy.MM.dd.HH.mm.ss" clause, then both of the queries are able to find the document and everything behaves as expected.

Anyone have an idea for what is going on? Am I miss understanding something fundamental at the query execution or is it a bug?

Thanks.
Michael.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.