GTE epoch brings results but GTE now-1d/d doesn't

Elastic Stack Elasticsearch
1

We have a rollup index with data timestamped to midnight of each day. So today we have data timestamped to midnight yesterday 2019-03-11T00:00:00.00000 CET.

We want to build a visualisation which always shows yesterday's data and thus we want to use now-1d/d in the query.

When we query the data with the epoch 1552258800000 (Monday, March 11, 2019 12:00:00 AM) we get results:

"range": {
    "timestamp.date_histogram.timestamp": {
        "gte": 1552258800000,
        "format": "epoch_millis"
    }
}

However, using relative dates back to yesterday midnight now-1d/d brings no results:

"range": {
    "timestamp.date_histogram.timestamp": {
     "gte": "now-1d/d",
     "lte": "now"
    }
}

Our data (returned in the first example with epoch_millis) has the following timestamp:

"timestamp.date_histogram.timestamp": 1552258800000,

Interestingly using Kibana the relative query does work and we get the data we want:
image

Of course, kibana doesn't use now-1d/d but gte: 1552258800000 so that's kinda frustrating...

2

Trial and error leads me to conclude that yesterday midnight is not now-1d/d but now-2d/d.

I'd always assumed rounding by day meant rounding down (as Kibana does) but this is obviously rounding up.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.