Interpret Text field as Date field during search

Elastic Stack Elasticsearch
1

When we initially started using Elasticsearch we missed to add mappings to one of our indices. So all the Fields are having default type of "keyword". Is there any way to perform the date range search by interpreting timestamp field as date type during search?. Mapping:

{
  "index_01_2022": {
    "mappings": {
      "properties": {
        "starttime": {
          "type": "text",
          "fields": {
            "keyword": {
              "type": "keyword",
              "ignore_above": 256
            }
          }
        },
        "timestamp": {
          "type": "text",
          "fields": {
            "keyword": {
              "type": "keyword",
              "ignore_above": 256
            }
          }
        }
      }
    }
  }
}

required search query:

{
  "query": {
    "bool": {
      "filter": {
        "range": {
          "timestamp": {
            "gte": "2022-01-01T00:00:00",
            "lte": "2022-01-02T00:00:00"
          }
        }
      }
    }
  }
}
2

yes, you can use range query with keyword type filed, such as:

{
  "query": {
    "bool": {
      "filter": {
        "range": {
          "timestamp.keyword": {
            "gte": "2022-01-01T00:00:00",
            "lte": "2022-01-02T00:00:00"
          }
        }
      }
    }
  }
}

but，you'd better reindex your data with the correct mapping，and not to use the default mapping

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.