# PERL Search::Elasticsearch - need to filter by time

**URL:** <https://discuss.elastic.co/t/perl-search-elasticsearch-need-to-filter-by-time/17204>\
**Category:** Elasticsearch\
**Created:** [April 25, 2014, 4:50pm UTC](https://discuss.elastic.co/t/perl-search-elasticsearch-need-to-filter-by-time/17204 "2014-04-25T16:50:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Eugedan](https://avatars.discourse-cdn.com/v4/letter/e/ea666f/32.png) [@Eugedan](https://discuss.elastic.co/u/Eugedan)\
**Post date:** [April 25, 2014, 4:50pm UTC](https://discuss.elastic.co/t/perl-search-elasticsearch-need-to-filter-by-time/17204/1 "2014-04-25T16:50:33Z")

</div>

Hello Gurus and Newcomers! Seeking your wisdom and help with  
Search::Elasticsearch module... I was actually very surprised to see no  
questions about this given limited Perl docs on the matter.

I am trying to match the log dates AND filter or search by time as well.  
The following works as expected giving me first 3 lines from the log for a  
given date:

my $es = Search::Elasticsearch-\>new(  
nodes =\> 'logs.server.local:9200',  
cxn\_pool =\> 'Sniff', ## "web servers and Elasticsearch servers are on the same network"  
);

my $results = $es-\>search(  
body =\> {  
query =\> {  
filtered =\> {  
query =\> { term =\> { component=\> 'ens\_iis' } },  
filter =\> {  
and =\> [  
{ term =\> { date=\> '2014-04-22' } },  
],  
},  
}  
}  
},  
from =\> 0,  
size =\> 3,  
timeout =\> 60,  
);

Enter code here...

However for the life of me i cannot get the time filter to work! I tried  
various different ways and either get incorrect results or none at all.  
Here's the most logical (in my eyes) attempt of such search that does NOT  
work:

my $results = $es-\>search(  
body =\> {  
query =\> {  
filtered =\> {  
query =\> { term =\> { component=\> 'ens\_iis' } },  
filter =\> {  
and =\> [  
{ term =\> { date=\> '2014-04-22' } },  
{ range =\> {  
time =\> {  
gte =\> '02:00:00',  
lt =\> '07:55:00'  
}  
}  
},  
],  
},  
}  
}  
},  
from =\> 0,  
size =\> 3,  
timeout =\> 60,  
);

This returns the same rows as without the filter with timestamps starting  
00:03:56. I tried various ways to escape the timestamps but without  
expected results.

Im not sure what i am missing here and will be grateful for any guidance  
and advice!

Thank you!

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/ebd0eedf-f47f-4d62-bf13-61ecd85d8120%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/ebd0eedf-f47f-4d62-bf13-61ecd85d8120%40googlegroups.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

**Author:** ![R\_Toma](https://avatars.discourse-cdn.com/v4/letter/r/e480ec/32.png) [@R\_Toma](https://discuss.elastic.co/u/R_Toma)\
**Post date:** [April 25, 2014, 5:55pm UTC](https://discuss.elastic.co/t/perl-search-elasticsearch-need-to-filter-by-time/17204/2 "2014-04-25T17:55:55Z")

</div>

Hi Eugedan,  
You may want to check the type of field 'time' in the index mapping.  
Regards,  
Renzo

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/2146e8a9-9682-451d-bd3b-6f915410b6e8%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/2146e8a9-9682-451d-bd3b-6f915410b6e8%40googlegroups.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

**Author:** ![Eugedan](https://avatars.discourse-cdn.com/v4/letter/e/ea666f/32.png) [@Eugedan](https://discuss.elastic.co/u/Eugedan)\
**Post date:** [April 25, 2014, 10:23pm UTC](https://discuss.elastic.co/t/perl-search-elasticsearch-need-to-filter-by-time/17204/3 "2014-04-25T22:23:28Z")

</div>

Thank you for your suggestion! 'time' is of type 'string'. When viewing  
records through Kibana, @fields.time looks like "hh:mm:ss" and message  
where this time is parsed from starts with "yyyy-mm-dd hh:mm:ss".

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/af76ebf8-71d6-4638-b8fd-cbd5f7380ee6%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/af76ebf8-71d6-4638-b8fd-cbd5f7380ee6%40googlegroups.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:33am UTC](https://discuss.elastic.co/t/perl-search-elasticsearch-need-to-filter-by-time/17204/4 "2017-07-06T01:33:26Z")

</div>