比较kibana搜索中的两个字段

Question

I have two fields one is timestamp which is associated with every record and one is expiryDate so I want to put a lucene query in the discover part search section such that it extract out the records for which expiry date > timestamp. Can anyone help me in writing the query. Consider online.timestamp as one field and online.expiry as another field.

Answer 1

You can write the below query:-

{"constant_score":{"filter":{"script" : { "script" : "doc['online.expiry'].value > doc['online.timestamp'].value"}}}}

You may see an error while using above query such as:-

ScriptException[scripts of type [inline], operation [search] and lang [groovy] are disabled]

To solve this error, edit your elasticsearch.yml file and enter the following property at the end:-

 script.inline:on

Then you can restart your Elasticsearch node or cluster and then query the same on Kibana which will fetch you desired records.