Elasticsearch过滤日期格式为日期的文档

Question

My documents in ES contain a field that stores date value in epoch format like this:

"received": 1521055535062

I am trying to build a query where I can filter documents based on a certain date with or without UTC time difference taken into account.

Since I have over a million records in ES , I would like a way to figure out how many of those documents belonged to a specific date.

Answer 1

What you are looking for is the date range query with date format specification that you want. The following should return the docs received on first day of 2018

GET _search
{
 "query": {
    "range" : {
        "received" : {
            "gte": "01/01/2018",
            "lt": "01/02/2018",
            "format": "dd/MM/yyyy"
        }
    }
 }
}

See here for the details https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-range-query.html

Answer 2

Just adding a snippet of Java code (using the range query). From the question, it's not clear in which language the query should be written but if it's in Java, following snippet should be helpful:

        BoolQueryBuilder boolQuery = new BoolQueryBuilder();
        Date asOfDate = new Date(System.currentTimeMillis() - historySeconds * 1000);
        boolQuery.must(QueryBuilders.rangeQuery("created").from(asOfDate).includeLower(true));