Elastic Search List all Keys for a Matching Condition with time range

Question

I have to search through the ES to print out the fields when it match's a condition for a time period.

Tried the below query to match one Number in last 24hours and it didnt give me an output

{
    "query": {
        "bool": {
            "must": {
                "match_phrase": {
                    "Number": "1234567"
                }
            },
            "filter": {
                "range": {
                    "@timestamp": {
                        "gte": "now-1d/d"
                    }
                }
            }
        }
    }
}'

I am looking for the query for listing all the numbers in last 24hours. Is there a way to get it.

The mappings for the index that I am are searching on is :

{
  "_index": "data-changes",
  "_type": "_doc",
  "_id": “123456”,
  "_version": 132,
  "_score": 0,
  "_source": {
    "work_notes": "",
    "priority": "4 - Low",
    "planned_start": 1557464400000,
    "Updated_by": "system",
    "Updated": 1557464427000,
    "description": “test of 123456“,
    "phase": "Requested",
    "Number": “123456”,
    "cmdb_ci": "",
    "review_status": "",
    "impact": "No - No impact",
    "phase_state": "Open",
    "Requested_by": “guest”,
    "requested_by_group": “guest_ninja”,
    "Short_description": “ninja rollout“,
    "risk": "Low",
    "actual_end": 0,
    "knowledge_id": "",
    "change_manager_group": “ninja_world_one”,
    "approval": "Approved",
    "downtime": "false",
    "close_notes": "",
    "Standard_template_version": "",
    "User_input": "",
    "ci_class": "Application",
    "category": "Other",
    "created_on": 1557426592000,
    "Created_by": “guest”,
    "Opened_by": “guest”,
    "State": "Implement",
    "availability_impacted": "None expected",
    "planned_end": 1557478800000,
    "close_code": null,
    "actual_start": 1557464427000,
    "closed_by": "",
    "Record_url": “http://localhost:8080”,
    "Type": "Normal"
  },
  "fields": {
    "planned_start": [
      "2019-05-10T05:00:00.000Z"
    ],
    "actual_start": [
      "2019-05-10T05:00:27.000Z"
    ],
    "actual_end": [
      "1970-01-01T00:00:00.000Z"
    ],
    "Updated": [
      "2019-05-10T05:00:27.000Z"
    ],
    "created_on": [
      "2019-05-09T18:29:52.000Z"
    ]
  },

You don't have any field named `@timestamp` in your document, you need to pick a date field that is present in your documents. — Val, May 10 '19 at 07:33

score 0 · Answer 1 · answered May 10 '19 at 07:55

Your query doesn't return anything because you don't have any @timestamp field in your document. You need to use an existing date field, such as planned_start for instance:

{
    "query": {
        "bool": {
            "must": {
                "match_phrase": {
                    "Number": "1234567"
                }
            },
            "filter": {
                "range": {
                    "planned_start": {
                        "gte": "now-1d/d"
                    }
                }
            }
        }
    }
}'

Elastic Search List all Keys for a Matching Condition with time range

1 Answers1