Timestamp range query

Elastic Stack Elasticsearch
1

My latest data is February 5th 2016, 13:18:10.036 to February 10th 2016, 20:00:19.590.

This query doesnt work:
curl -XGET http://localhost:9200/member_type_history -d '{"query":{"filter":{"range":{"@timestamp":{"gt":"2016-02-05T13:18:10.036", "lt" : "2016-02-05T23:59:59.590"}}}}}'

What am I doing wrong? The data is there.

2

What is your mapping and can you show a doc which should match?

3

I run this command:
curl -XGET http://localhost:9200/member_type_history -d '{"query":{"filter":{"range":{"@timestamp":{"gt":"2016-02-05 00:00:00.000", "lt" : "2016-03-05 23:59:59.000"}}}}}'

And get this response:
{"member_type_history":{"aliases":{},"mappings":{"Member Type":{"properties":{"@timestamp":{"type":"date","format":"strict_date_optional_time||epoch_millis"},"@version":{"type":"string"},"ATSID":{"type":"string"},"Age":{"type":"long"},"DegreeDesignation":{"type":"string"},"Email":{"type":"string"},"Fax":{"type":"string"},"FirstName":{"type":"string"},"Gender":{"type":"string"},"HomePhone":{"type":"string"},"LastName":{"type":"string"},"Member Type":{"type":"string","index":"not_analyzed"},"MembershipExpireDate":{"type":"string"},"MiddleName":{"type":"string"},"NPINumber":{"type":"string"},"Phone":{"type":"string"},"RequestDoNotCall":{"type":"string"},"RequestDoNotEmail":{"type":"string"},"Salutation":{"type":"string"},"Suffix":{"type":"string"},"Title":{"type":"string"},"atsJoinDate":{"type":"string"},"atsJoinYear":{"type":"long"},"id":{"type":"string"},"type":{"type":"string"}}}},"settings":{"index":{"creation_date":"1454695858727","number_of_shards":"5","number_of_replicas":"1","uuid":"wi0l903pRg68jKXBvyDV5A","version":{"created":"2000099"}}},"warmers":{}}}

Here is a screen shot showing I have data for the stated time frame:

query_ELK.jpg641×852 95.9 KB

4

The second query is not the same as the first one. Why this?

Then where is the sample document? Can't find it.

5

Yes, the query is different, but same purpose.

Here is the JSON for a document:

{
"_index": "member_type_history",
"_type": "Member Type",
"_id": "AVKyp9mo9RA4myKx5rpC",
"_score": null,
"_source": {
"id": "0014000000PaOsyAAF",
"NPINumber": null,
"ATSID": "54545",
"Salutation": "Dr.",
"FirstName": "Joe",
"MiddleName": null,
"LastName": "Doe",
"RequestDoNotEmail": "No",
"Email": "email@net.com",
"RequestDoNotCall": "No",
"Phone": "27 333333",
"HomePhone": null,
"Fax": "23 44444",
"Title": null,
"Suffix": null,
"DegreeDesignation": "MD",
"Gender": "Male",
"Age": 66,
"Member Type": "Senior ATS Membership (International)",
"MembershipExpireDate": "2016-02-21 00:00:00 +0000",
"atsJoinYear": 1992,
"atsJoinDate": null,
"@version": "1",
"@timestamp": "2016-02-05T18:18:10.036Z",
"type": "Member Type"
},
"fields": {
"@timestamp": [
1454696290036
]
},
"sort": [
1454696290036
]
}

Here is a screen shot of the document in Kibana:

document.jpg520×972 94.3 KB

6

Which version?

7

And can you reproduce your issue with a full script?
Here it's hard to follow because you changed the query in the meantime.

8

ES is 2.0, Kibana is 4.2

9

Ok. Can you reproduce it with a script? I'm not talking about Kibana here but only elasticsearch.