Ranges with one side?

Elastic Stack Kibana
1 
GET filebeat-*/_search
{
  "query": {
      "bool": {
        "must": [
        {
           "query_string": {
            "analyze_wildcard": true,
             "query": "message:>1000,
             "fuzzy_max_expansions": 50
         }
       
           },
       {
                  "range": {
                    "@timestamp": {
                      "gte": "now-5m",
                      "lte": "now",
                      "format": "epoch_millis"
                    }
                  }
                }
       ]
     }
   }
}

I want bigger than 1000,but reslut 500 is out too.

2

I don't understand what you want here. You want to query where message is >1000 or you want more than 500 results?

3

I want to query where message is >1000

4

sorry, I want to query where message is >1000. but now the result 500 is query out too...

5

thanks you for you reply,I get it, this string type,not number。。。

6

If you don't want to ingest the data again, you could use a scripted field to convert the data from the message field.

7

OK,thanks you!

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.