I'm writing a query to count the number of API with long latency. These two queries are getting very different results but I don't know why.
POST /_count
postSlowQueries = '{"query":{"query_string":{"query":"latency:['+str(slowLatency)+' TO *] AND @timestamp:[' + minutes_5_ago.strftime("%Y-%m-%dT%H:%M:%S") + ' TO *]"}}}'
postSlowQueries = '{"query": {"range":{"latency": {"gte": "'+str(slowLatency)+'"}, "@timestamp": {"gte": "' + minutes_5_ago.strftime("%Y-%m-%dT%H:%M:%S") + '"}}}}'
Thank you in advance!