How to pass in `current_unix_time` as a value for elasticsearch query?

Elastic Stack Elasticsearch
,
1

My ultimate goal is to create a Kibana visualization that shows "How many days have passed since [today]". I was told I might be able to create an elasticsearch query that passes in a current_unix_time or (new Date()).getTime() or NOW() or similar, then use Vega to draw a visualization for my dashboard.

I understand that I can NOT put in a unix time as part of my painless script.source query (because if the distributed computing nature of an elastic cluster), but then someone told me to try to supply a current time as a script.params. But I don't know the right syntax. Here's an example of what I tried:

GET myindex/_search
{
  "runtime_mappings": {
    "new_field": {
      "type": "keyword",
      "script": {
        "source": "emit(params['now'])",
        "params": {
          "now": "(new Date()).getTime()"
          }
      }
    }
  },
    "aggs":{
    "new_field": {
      "terms": {
      "field": "new_field"
      }
    }
  }

But the run time field just gives me the literal string (new Date()).getTime() and not the actual time value. I've tried other things like changing the runtime field type, other possible functions/methods that I think might give me a time, but I still can't figure it out.

What am I doing wrong? What's the best way to work with a current_time in a painless script? Or to plot visualizations that can do something like DATE_DIFF( docs['projectDueDate'].date , NOW() )?

2

Hi @learningelastic

Let's back up a bit

I am confused what you are actually trying to accomplish....

Are you trying to calculate the number of days from Today / Now with respect to a date field in the document?

I am not sure where that understanding comes from...

Perhaps you are looking to do something like this

1 Like
3

Perfect! Based on that answer, I made this example for myself, which shows number of days a project has been overdue:

PUT runtime_field
{
  "mappings": {
    "properties": {
      "dueDate": {
        "type": "date",
        "format": "yyyy-MM-dd"
      }
    }
  }
}

POST runtime_field/_doc
{
  "dueDate": "2023-04-01"
}

GET runtime_field/_search
{
  "runtime_mappings": {
    "daysOverdue": {
      "type": "long",
      "script": {
        "source": """
          long current = (new Date()).getTime();
          long dueDate = doc['dueDate'].value.getMillis();
          long days = Math.round((current - dueDate)/(1000*3600*24));
          emit(days)
          """
      }
    }
  },
    "aggs":{
    "daysOverdue": {
      "terms": {
      "field": "daysOverdue"
      }
    }
  }
}
1 Like
4

You can just add that runtime mapping to the index mapping and then it will always be there...

Although if you only need it when you do that search the way you're doing it is perhaps a bit more efficient.

Either way, it's good and thanks for posting your answer. It may help someone else!

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.