elasticsearch specific hours

Question

I am trying to write a query that will only return results for the current hour in the day, x days back. for instance if the time now is 12:00 I want to get the results in range 11:00-12:00 for each day, 14 days back. I have seen Elasticsearch sum total values for specific hours within a month but it requires me to choose fixed hours. simply extracting the hour from "now" won't do, since going back 1 hour might result in moving to yesterday, and then the range won't work.

Answer 1

You can use a filtered bool query with multiple should range filters. You can calculate the hour date ranges in code and dynamically build the query for the X number of days. The example below is for 3 days calculated at 00:30 (so crosses the day boundary)

{
    "query": {
        "filtered": {
            "query": {
                "match_all": {}
            },
            "filter": {
                "bool": {
                    "should": [
                       { "range": {
                           "myDateField" : {
                               "gte" : "2015-11-18T23:30:00.00",
                               "lt" : "2015-11-19T00:30:00.00"
                            }
                        }},
                        { "range": {
                            "myDateField" : {
                                "gte" : "2015-11-17T23:30:00.00",
                                "lt" : "2015-11-18T00:30:00.00"
                            }
                        }},
                        { "range": {
                            "myDateField" : {
                                "gte" : "2015-11-16T23:30:00.00",
                                "lt" : "2015-11-17T00:30:00.00"
                            }
                        }}
                    ]
                }

            }
        }
    }
}