Query string with range

I'm having difficulties getting the this one right.
What did I miss?

{
"query": {
"query_string" : {
"analyze_wildcard": true,
"query" : "failed to add key to cache"
},
"range": {
"@timestamp": {
"gte": "now-900s"
}
}
}
}

If you want to combine multiple queries - in this case the range and the query string - you will have to wrap them in a bool query. This is how the correct query will look like:

{
  "query": {
    "bool": {
      "must": [
        {
          "query_string": {
            "analyze_wildcard": true,
            "query": "failed to add key to cache"
          }
        },
        {
          "range": {
            "@timestamp": {
              "gte": "now-500d"
            }
          }
        }
      ]
    }
  }
}
3 Likes

This does not quite seem to cut it though.

I was looking to find the EXACT term "failed to add key to cache".

This however is looking for any of the words in it.

found it!

"failed to add key to cache"
should be
""failed to add key to cache""

thanks!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.