带有日期和术语的ElasticSearch查询

Question

Here is my query

{
    "filter": {
        "bool": {
            "must": [{
                "range": {
                    "timestamp": {
                        "gte": "now-24"
                    }
                }
            }, {
                "term": {
                    "program": "dashboard"
                }
            }]
        }
    }
}

Data sample in elasticsearch:

 {
"_index": "logstash-2015.09.14",
"_type": "logs",
"_id": "AU_MPG6xoSXeyoJeeaQ1",
"_score": 1,
"_source": {
"message": "testing for clustering--473983--https://github.com/mobz/elasticsearch-headThis will automatically download the latest version of elasticsearch-head from github and run it as ugin within the elasticsearch cluster.",
"@version": "1",
"@timestamp": "2015-09-14T14:23:16.000Z",
"host": "172.17.42.1",
"priority": 13,
"timestamp": "Sep 14 14:23:16",
"logsource": "cn1",
"program": "ubuntu",
"severity": 5,
"facility": 1,
"facility_label": "user-level",
"severity_label": "Notice",
"event_time": "2015-09-14 14:23:16 UTC"
}
}

How can I pass `

from and to date

in this query if timestamp in "timestamp": "Sep 14 06:19:10"` this format please someone help me.

Answer 1

You might use:

{
    "query": {
        "bool": {
            "must": [
                {
                    "term": {
                        "program": "dashboard"
                    }
                },
                {
                    "range": {
                        "@timestamp": {
                            "from": "2015-09-14T20:56:52.404Z",
                            "to": "2015-09-14T20:57:02.686Z"
                        }
                    }
                }
            ]
        }
    }
}

Regards, Alain

Answer 2

If you want to filter on event_time field, try this:

{
    "query": {
        "bool": {
            "must": [
                {
                    "term": {
                        "program": "dashboard"
                    }
                },
                {
                    "range": {
                        "logs.event_time": {
                            "from": "2015-09-13",
                            "to": "2015-09-14"
                        }
                    }
                }
            ]
        }
    }
}

Regards, Alain