Ranges with one side?

[aabababba]

GET filebeat-*/_search
{
  "query": {
      "bool": {
        "must": [
        {
           "query_string": {
            "analyze_wildcard": true,
             "query": "message:>1000,
             "fuzzy_max_expansions": 50
         }
       
           },
       {
                  "range": {
                    "@timestamp": {
                      "gte": "now-5m",
                      "lte": "now",
                      "format": "epoch_millis"
                    }
                  }
                }
       ]
     }
   }
}

I want bigger than 1000,but reslut 500 is out too.

[Marius_Dragomir]

I don't understand what you want here. You want to query where message is >1000 or you want more than 500 results?

[aabababba]

I want to query where message is >1000

[aabababba]

sorry, I want to query where message is >1000. but now the result 500 is query out too...

[aabababba]

thanks you for you reply,I get it, this string type,not number。。。

[Marius_Dragomir]

If you don't want to ingest the data again, you could use a scripted field to convert the data from the message field.

[aabababba]

OK,thanks you!