I find out that match with range query is not working.
When I search data using range query, I can see "ACTION" text in payload field.
But when I search data using both range and match, I can see empty result.
Thank you in advance
Please don't post images of text as they are hardly readable and not searchable.
Instead paste the text and format it with </>
icon. Check the preview window.
{
"query":{
"bool":{
"must":[
{
"match": {
"service": "OG064301"
}
},
{
"match": {
"payload": "ACTION"
}
}
],
"filter":[
{
"range":{
"timestamp":{
"lt":"2018-12-19T14:34:00.000Z",
"gt":"2018-12-19T14:24:00.000Z"
}
}
}
]
}
}
}
We use whitespace analyzer with lowercase filter on payload field.
and we cannot search data using both range and match.
maybe the problem is your service field
Are you sure you have any results within that 10 minute date range?
I've been bitten by time zone and day light saving problems a few times, expecting certain documents but not finding them until I added an extra hour to the date range, so you may want to try that. At least just as a test of the range filter. For instance
"timestamp": {
"lt": "2018-12-19T16:34:00.000Z",
"gt": "2018-12-19T12:24:00.000Z"
}
If this turns out to be a question of different time zones, you will need to add the time zone info as part of the date range filter. For instance like this for a +2 hour shift:
"timestamp": {
"lt": "2018-12-19T14:34:00+02:00",
"gt": "2018-12-19T14:24:00+02:00"
}
I am sure that date range is not a problem.
When I search for data using that date range, I can see 'ACTION' text in payload field.
and When I only query data using "match": {
"payload": "ACTION"
}
, I can see timestamp which has ""2018-12-19T14:25:00.000Z"
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.