How do date searches work


(Matthias Götzke) #1

I am trying to store/search dates in ES but am experiencing some
difficulties. It seems a few things are going on there which i do not fully
understand yet.

When searching for a specific field with a query_string query then i
everything behaves as expected. E.g. searching for "created:[20120101 to
20150101]
" finds the document.

When searching without specifying the field "[20120101 to 20150101]" it
does only seem to perform a generic prefix match query and thus it returns
the second document in the database only not the one indexed using the unix
timestamp.

Is there anyway to let lucene or ES do all 3 types of range queries ? E.g.
perform a string match,perform a date range and perform a number match
using some default date formats ?

Any help is greatly appreciated.

Regards,
Matthias Goetzke

I included some test data below for use in sense etc ..:

POST /test/file/3
{
"name":"my file",
}

PUT test/file/_mapping

{
"file": {
"properties": {
"created": {
"type": "date",
"format": "yyyyMMdd"
},
"name": {
"type": "string"
}
}
}
}

Indexing documents like:

POST /test/file/1
{
"name":"my file",
"created": 1384359659000
}
POST /test/file/2
{
"name":"my file",
"created": "20120101"
}

I would expect to be able to search using a date range query then:

POST /test/file/_search
{
"query": {
"query_string": {
"query": "[20120101 TO 20140101]"
}
}
}

But this is not working .. what does work is WITH the explicit field:

POST /test/file/_search
{
"query": {
"query_string": {
"query": "created:[20120101 TO 20140101]"
}
}
}

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.


(Radu Gheorghe) #2

Hello Matthias,

I think this is because query_strings searches the "_all" field by default,
and that's not a date field, so date matches won't work. So maybe you can
throw in the "created" field specifically. Something like:

{
"query": {
"query_string": {
"query": "created:[20120101 TO 20140101]",
"fields": ["_all", "created"]
}
}
}

Best regards,
Radu

Performance Monitoring * Log Analytics * Search Analytics
Solr & Elasticsearch Support * http://sematext.com/

On Wed, Nov 13, 2013 at 9:00 AM, Matthias Götzke mgt576@gmail.com wrote:

I am trying to store/search dates in ES but am experiencing some
difficulties. It seems a few things are going on there which i do not fully
understand yet.

When searching for a specific field with a query_string query then i
everything behaves as expected. E.g. searching for "created:[20120101 to
20150101]
" finds the document.

When searching without specifying the field "[20120101 to 20150101]" it
does only seem to perform a generic prefix match query and thus it returns
the second document in the database only not the one indexed using the unix
timestamp.

Is there anyway to let lucene or ES do all 3 types of range queries ? E.g.
perform a string match,perform a date range and perform a number match
using some default date formats ?

Any help is greatly appreciated.

Regards,
Matthias Goetzke

I included some test data below for use in sense etc ..:

POST /test/file/3
{
"name":"my file",
}

PUT test/file/_mapping

{
"file": {
"properties": {
"created": {
"type": "date",
"format": "yyyyMMdd"
},
"name": {
"type": "string"
}
}
}
}

Indexing documents like:

POST /test/file/1
{
"name":"my file",
"created": 1384359659000
}
POST /test/file/2
{
"name":"my file",
"created": "20120101"
}

I would expect to be able to search using a date range query then:

POST /test/file/_search
{
"query": {
"query_string": {
"query": "[20120101 TO 20140101]"
}
}
}

But this is not working .. what does work is WITH the explicit field:

POST /test/file/_search
{
"query": {
"query_string": {
"query": "created:[20120101 TO 20140101]"
}
}
}

--
You received this message because you are subscribed to the Google Groups
"elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.


(system) #3