How do I filter a regexp query by timestamp?


#1

I'm trying to make a query that will search based on a regular expression, then filter out the results based on a timestamp eventTimeStamp

Here is the link to the query I was trying to execute

and the error that resulted from it

I haven't been able to find anything about this elsewhere, which leads me to believe that what I'm trying to do is not possible.

Any help is appreciated.


#2

You have an error in the syntax.
You cannot have regex and range queries on the same level.
You need to combine them with a bool query for example :

GET firehose-raw/_search
{
  "query": {
    "bool": {
      "filter": {
        "range": {
          "eventTimeStamp": {
            "lte": "2018-05-10T05:05:05.005"
          }
        }
      },
      "should": [
        {
          "regexp": {
            "rawlog.keyword": ".*unresponsive target=/.*"
          }
        }
      ]
    }
  }
}

(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.