Help Searching the data from my index

my index save data structure is the pic below:

index info:

"1":{
    "aliases":{},
    "mappings":{
        "properties":{
            "DeviceId":{
                "type":"text",
                "fields":{
                    "keyword":{
                        "type":"keyword",
                        "ignore_above":256
                    }
                }
            },
            "Duration":{
                "type":"text",
                "fields":{
                    "keyword":{
                        "type":"keyword",
                        "ignore_above":256
                    }
                }
            },
            "FileName":{
                "type":"text",
                "fields":{
                    "keyword":{
                        "type":"keyword",
                        "ignore_above":256
                    }
                },
                "fielddata":true
            },
            "Hls":{
                "type":"text",
                "fields":{
                    "keyword":{
                        "type":"keyword",
                        "ignore_above":256
                    }
                }
            },
            "StartAt":{
                "type":"text",
                "fields":{
                    "keyword":{
                        "type":"keyword",
                        "ignore_above":256
                    }
                }
            }
        }
    },
    "settings":{
        "index":{
            "creation_date":"1589015659889",
            "number_of_shards":"1",
            "number_of_replicas":"1",
            "uuid":"JRmRGN7GSpOU4NfrHyTJ_g",
            "version":{
                "created":"7060299"
            },
            "provided_name":"1"
        }
    }
}

}

I have a requirement to search the filename field. FileName 's structure is IndexName/YYYYMMDD/hhmmss.m3u8.
I need to find out which day of the month there is a file name record.

Date infomation is only stored in FileName.

Any Sugguestion?

Your best option is to split that out into it's own field.
You might be able to do that with a script, but that's outside my knowledge sorry.

thx for reply :heartbeat:

Snowfall,
Are you trying to search docs for a specific date or extract unique dates from docs? For later you can use script as suggested by Mark

{
  "size": 0,
  "aggs": {
    "dates": {
      "terms": {
        "field": "FileName.keyword",
        "script": {
          "source": "int s1 = _value.indexOf('/'); int s2 = _value.indexOf('/', s1+1); _value.substring(s1+1,s2)",
          "lang": "painless"
        }
      }
    }
  }
}
2 Likes

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.