Query string with range

Elastic Stack Elasticsearch
2

If you want to combine multiple queries - in this case the range and the query string - you will have to wrap them in a bool query. This is how the correct query will look like:

{
  "query": {
    "bool": {
      "must": [
        {
          "query_string": {
            "analyze_wildcard": true,
            "query": "failed to add key to cache"
          }
        },
        {
          "range": {
            "@timestamp": {
              "gte": "now-500d"
            }
          }
        }
      ]
    }
  }
}
3 Likes