Fetch Last 15 minute of data

Elastic Stack Elasticsearch
1

Here is my query for fetching the result of today last 15 minutes

{
  "query": {
     "bool": {
    "filter": [
      {
        "bool": {
          "should": [
            {
              "match_phrase": {
                "ResponseCode": "005"
              }
            },
            {
              "match_phrase": {
                "ResponseCode": "008"
              }
            },
            {
              "match_phrase": {
                "ResponseCode": "081"
              }
            },
            {
              "match_phrase": {
                "ResponseCode": "091"
              }
            },
            {
              "match_phrase": {
                "ResponseCode": "096"
              }
            },
            {
              "match_phrase": {
                "ResponseCode": "900"
              }
            },
            {
              "match_phrase": {
                "ResponseCode": "009"
              }
            },
            {
              "match_phrase": {
                "ResponseCode": "0068"
              }
            },
            {
              "match_phrase": {
                "ResponseCode": "153"
              }
            },
            {
              "range":
              {
                "timestamp":
                {
                   "gte":"now-15m"
                }
              }
            }
          ],
          "minimum_should_match": 1
        }
      }
    ],
    "must_not": []
  }
  }
}

But i am getting older data of previous month.

2

Can you share an example of a document from previous month that is being returned by this query?

3

You need to move your range filter to a new bool/should clause/filter. Currently you have it in the same filter as your ResponseCode, but then you also have "minimum_should_match": 1 set, so your query is really saying, match one of these ResponseCodes OR any document with the timestamp range.

3 Likes
4

@BenB196 , now i am getting zero result
Can you please tell me where i am making mistake

{
  "query": {
     "bool": {
    "filter": [
      {
        "bool": {
          "should": [
            {
              "match_phrase": {
                "ResponseCode": "005"
              }
            },
            {
              "match_phrase": {
                "ResponseCode": "008"
              }
            },
            {
              "match_phrase": {
                "ResponseCode": "081"
              }
            },
            {
              "match_phrase": {
                "ResponseCode": "091"
              }
            },
            {
              "match_phrase": {
                "ResponseCode": "096"
              }
            },
            {
              "match_phrase": {
                "ResponseCode": "900"
              }
            },
            {
              "match_phrase": {
                "ResponseCode": "009"
              }
            },
            {
              "match_phrase": {
                "ResponseCode": "0068"
              }
            },
            {
              "match_phrase": {
                "ResponseCode": "153"
              }
            }
          ],
          "minimum_should_match": 1
        }
      },
      {
        "bool": {
          "should":
          {
             "range":
              {
                "timestamp":
                {
                   
                   "gte":"now-15m"
                }
              }
          }
        }
      }
    ],
    "must_not": []
  }
}
}
5

Thank you @leandrojmp and @BenB196 for your help i miss the @ in timestamp

{
  "query": {
     "bool": {
    "filter": [
      {
        "bool": {
          "should": [
            {
              "match_phrase": {
                "ResponseCode": "005"
              }
            },
            {
              "match_phrase": {
                "ResponseCode": "008"
              }
            },
            {
              "match_phrase": {
                "ResponseCode": "081"
              }
            },
            {
              "match_phrase": {
                "ResponseCode": "091"
              }
            },
            {
              "match_phrase": {
                "ResponseCode": "096"
              }
            },
            {
              "match_phrase": {
                "ResponseCode": "900"
              }
            },
            {
              "match_phrase": {
                "ResponseCode": "009"
              }
            },
            {
              "match_phrase": {
                "ResponseCode": "0068"
              }
            },
            {
              "match_phrase": {
                "ResponseCode": "153"
              }
            }
          ],
          "minimum_should_match": 1
        }
      },
      {
        "bool": {
          "should":{
          "range": {
            "@timestamp": {
              "gte": "now-15m"
            }
          }
          }
        }
      }
    ],
    "must_not": []
  }
}
}
1 Like
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.