Quering nullable timstamp field

Elastic Stack Elasticsearch
1

I have user index like below

name: text
frozen_until: timestamp

I want to query all users which...
(frozen_until == null || frozen_until < today)

below is the query I'm struggling with:

{
	"query": {
		"bool": {
			"should": [{
				"bool": { 
					"must_not": {
						"exists": {
							"field": "frozen_until"
						}
					}
				}
			},
			{
				"filter": {
					"range": {
						"frozen_until": {
							"lte": "now/d"
						}
					}
				}
			}
			],
			"minimum_should_match": 1
		}
	}
}

error message: "reason": "[14:14] [bool] failed to parse field [should]",

how can I use range filter inside should?

2

Remove "filter" line. Try this

{
  "query": {
    "bool": {
      "should": [
        {
          "bool": {
            "must_not": {
              "exists": {
                "field": "frozen_until"
              }
            }
          }
        },
        {
          "range": {
            "frozen_until": {
              "lte": "now"
            }
          }
        }
      ]
    }
  }
}
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.