Query string with range

Elastic Stack Elasticsearch
1

I'm having difficulties getting the this one right.
What did I miss?

{
"query": {
"query_string" : {
"analyze_wildcard": true,
"query" : "failed to add key to cache"
},
"range": {
"@timestamp": {
"gte": "now-900s"
}
}
}
}

2

If you want to combine multiple queries - in this case the range and the query string - you will have to wrap them in a bool query. This is how the correct query will look like:

{
  "query": {
    "bool": {
      "must": [
        {
          "query_string": {
            "analyze_wildcard": true,
            "query": "failed to add key to cache"
          }
        },
        {
          "range": {
            "@timestamp": {
              "gte": "now-500d"
            }
          }
        }
      ]
    }
  }
}
3 Likes
3

This does not quite seem to cut it though.

I was looking to find the EXACT term "failed to add key to cache".

This however is looking for any of the words in it.

4

found it!

"failed to add key to cache"
should be
""failed to add key to cache""

thanks!

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.