Time range being ignored


(bluren) #1

I have mimicked how kibana does a query search and have come up with the below query. Basically I'm looking for the lat 6 days of data (including those days where there is no data, since I need to feed it to a graph). But the returned buckets is giving me more than just those days. I woul like to understand where I'm going wring with this.

 {
     "version": true,
     "size": 0,
     "sort": [
         {
             "@timestamp": {
                 "order": "desc",
                 "unmapped_type": "boolean"
             }
         }
     ],
     "_source": {
         "excludes": []
     },
     "aggs": {
         "target_traffic": {
             "date_histogram": {
                 "field": "@timestamp",
                 "interval": "1d",
                 "time_zone": "Asia/Kolkata",
                 "min_doc_count": 0,
                 "extended_bounds": {
                     "min": "now-6d/d",
                     "max": "now"
                 }
             },
             "aggs": {
                 "days_filter": {
                     "filter": {
                         "range": {
                             "@timestamp": {
                                 "gt": "now-6d",
                                 "lte": "now"
                             }
                             
                         }
                     },
                     "aggs": {
                         "in_bytes": {
                             "sum": {
                                 "field": "netflow.in_bytes"
                             }
                         },
                         "out_bytes": {
                             "sum": {
                                 "field": "netflow.out_bytes"
                             }
                         }
                     }
                 }
             }
         }
     },
     "stored_fields": [
         "*"
     ],
     "script_fields": {},
     "docvalue_fields": [
         "@timestamp",
         "netflow.first_switched",
         "netflow.last_switched"
     ],
     "query": {
         "bool": {
             "must": [
                 {
                     "query_string": {
                         "query": "( flow.src_addr: (  \"10.5.5.1\" OR \"10.5.5.2\" ) OR flow.dst_addr: (  \"10.5.5.1\" OR \"10.5.5.2\" ) ) AND flow.traffic_locality: \"private\"",
                         "analyze_wildcard": true,
                         "default_field": "*"
                     }
                 }
             ]
         }
     }
 }

(Alexander Reelsen) #2

the time range should be part of the query using a range query


(bluren) #3

Thanks for this. I've got it working now.


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.