如何查询Elasticsearch以获取两个时间戳之间的数据

Question

Recently I have been using a timestamp based query to get data form my ELK stack and avoid repeats. Now I would like to implement getting information between two specific timestamps.

Here is my current query:

{
  "query": {
    "range": {
      "runtime_timestamp": {
       "gt": "2017-03-18T22:00:55.964Z"
    }  
   }
  },
  "_source": {
  "includes": [
  "field1",
  "field2"
]
},
"sort": [
{
  "@timestamp": {
    "order": "desc"
  }
}
]
}

I have looked at the docs and I can't seem to find a way to do it. Any ideas?

Answer 1

You can add a "lt" or "lte" to your existing range query as described here: https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-range-query.html

{
  "query": {
    "range": {
      "runtime_timestamp": {
        "gt": "2017-03-18T22:00:00.000Z",
        "lt": "2017-03-18T22:10:00.000Z"
      }
    }
  },
  "_source": {
    "includes": [
      "field1",
      "field2"
    ]
  },
  "sort": [
    {
      "@timestamp": {
        "order": "desc"
      }
    }
  ]
}