query for documents with datetime field where time is outside office hours.
There's a field vraag_datumtijd (same format as @timestamp) that's filled with a date time stamp of the moment of doing an user action and a field username. I would like to query the documents of yesterday and show the username that requests for documents outside office hours.
In some way I do receive results with above query as filter (in esql), but 2 problems I cannot get properly achieved.
The time seems to differ with one hour (@timestamp field is 1 hour offset from vraag_datumtijd field (this might be the timezone difference)
I would like to split the time as a separate filter, so that day range queried can be seen apart from the office hour filter (when using a range of more days, it still should filter for the office hours each day
The time seems to differ with one hour (@timestamp field is 1 hour offset from vraag_datumtijd field (this might be the timezone difference)
Yes, it seems like you're dealing with timezones here. You can provide the time_zone for range queries.
I would like to split the time as a separate filter, so that day range queried can be seen apart from the office hour filter (when using a range of more days, it still should filter for the office hours each day
You could use a script filter for that, and separate it from your range query. Something similar to:
Thanks for your reply. the filter works, but I'm not sure this matches my situation. Working day is from 6-23 hours. The ranges for the time filter therefore should be for document requests made between 23 till 24 hours and between 00 to 06 hours. Can you help me with an example of an OR construction of the filter that achieves this?
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.