Query last one hour records

Elastic Stack Elasticsearch
1

I am having serious trouble in querying last one hour records and my query with filter "gte" : "now-1h" does not result in any data.

The time on my box is

1459456163

The data of time stamps are in range : 1459455130 to 1459455131 .... The query results no data

GET _search
{
"filter" :{
"query": {
"range": {
"Time": {
"gte" : "now-1h"
}
}
}
}
}

2

You are close Try this: (use timestamp instead of time.)

GET _search
{
"filter" :{
"query": {
"range": {
"timestamp": {
"gte" : "now-1h"
}
}
}
}
}

3

What does your mapping look like?

4

My Mapping is
{
"settings": {
"index.number_of_shards": 1,
"index.number_of_replicas": 0
},
"mappings": {
"doc": {
"_timestamp": {
"enabled": "true"
},
"properties": {
"lists" : {
"properties" : {
"Values": { "type": "string" }
}
},
"Id" : {
"type": "string"
},
"Status" : {
"type": "string"
},
"From" : {
"type": "string"
},
"Time": {
"type": "date"
}
}
}
}
}

Changing timestamp to Time does not help..

5

This is from querying the mapping

{
"configlogs": {
"mappings": {
"CONTAINER": {
"properties": {
"From": {
"type": "string"
},
"Id": {
"type": "string"
},
"Status": {
"type": "string"
},
"Time": {
"type": "date",
"format": "strict_date_optional_time||epoch_millis"
}
}
},
"VOLUME": {
"properties": {
"From": {
"type": "string"
},
"Id": {
"type": "string"
},
"Status": {
"type": "string"
},
"Time": {
"type": "date",
"format": "strict_date_optional_time||epoch_millis"
}
}
},
"doc": {
"_timestamp": {
"enabled": true
},
"properties": {
"From": {
"type": "string"
},
"Id": {
"type": "string"
},
"Status": {
"type": "string"
},
"Time": {
"type": "date",
"format": "strict_date_optional_time||epoch_millis"
},
"lists": {
"properties": {
"Values": {
"type": "string"
}
}
}
}
}
}
}
}

6

Looks ... it is problem with the time stamp precision ... a precision of milli seconds ...

1459460126971

7

you could be correct.
The system may not know how to extract now-1h from epoch in milliseconds.
I would change the current time to epoch and subtract how many millis are in one hour.

8

I am able to reproduce the issue ...it is about having a mapping with type date and default "format": "strict_date_optional_time||epoch_millis" and then sending time values which is not milli second precision e.g. 1459456163

9

There may be a way to use an analyzer to change your query into epoch precision so your queries will match your data.
I am not that good with analyzers.

Anyone else?