Filtering to include only records in 5-minute intervals using a date field

[sreliable]

Hi all,

Currently all my documents in my index contain the CleanDate field which is date type:

{"CleanDate" : "2020-04-24T05:42:00.000Z"}

My documents are being shipped into elasticsearch every minute.
Is there a way for me to include a filter on visualizations/dashboard to only include documents with CleanDate that are multiples of 5minutes?

ie.

Accepted

"2020-04-24T05:00:00.000Z"
"2020-04-24T05:05:00.000Z"
"2020-04-24T05:10:00.000Z"
"2020-04-24T05:15:00.000Z"

Rejected

"2020-04-24T05:01:00.000Z"

Solutioning

I have tried filtering by scripted fields as below:

return doc['CleanDate'].value.getMinute();

This does return the minute, however when I try to filter them using the filter UI icon, no records show up.

I've also tried using the following scripted field as per documentation to no luck:
return doc['CleanDate'].date.minuteOfHour;
This does not return anything -

Please help. Thanks!

[flash1293 (Joe Reuter)]

The first script using getMinute looks right to me. I tested it locally and it worked fine:

I'm just guessing at that point, but did you try to use multiple filters like this?

That wouldn't work, because these filters are connected by "AND"s - each document has to match all of them. As no document can have both value 28 and 30 as "minute", no results show up.

I recommend the following - create a scripted field of type boolean called is5MinuteMultiple with the following script:

return doc['CleanDate'].value.getMinute() % 5 == 0;

Then filter by this field getting true:

[sreliable]

Hey Joe,

I did not try using multiple filters like that, its weird but even when I put a simple filter like minute exists, it would show No results found.

Anyway, I tried your solution and it worked like a charm
Thanks for the advice!