Elasticsearch query to get items that were modified more then an hour ago-CodePudding

I have the following indexed items in elasticsearch.

{
 "_index": "test_index",
 "type": "_doc",
 "_source": {
   "someTitle": "Thank you for your help",
   "lastUpdated": 1640085989000}
},
{
 "_index": "test_index",
 "type": "_doc",
 "_source": {
   "someTitle": "Thank you for your help",
   "lastUpdated": 1640092916012
  }
},
{
 "_index": "test_index",
 "type": "_doc",
 "_source": {
   "someTitle": "Thank you for your help",
   "lastUpdated": 1640092916012
  }
}

How to get the items that were updated more than an hour ago based on that lastUpdated value? I have been trying some solutions found in internet but most of them are for querying the string but not number field.

CodePudding user response：

It feels like a range query would do the work [doc]

The section you are looking for is range on dates

Your query should look more or less like that:

GET /<your index>/_search
{
  "query": {
    "range": {
      "lastUpdated": {
        "gte": "now-1h"
      }
    }
  }
}

Make sure your mapping is right, and that lastUpdated has the right format [doc].

CodePudding user response：

ES gives you keywords like now and h for simple date math queries. Along with a range query you should be able to do it:

{
  "query": {
    "range": {
      "lastUpdated": {
        "lt": "now-1h"
      }
    }
  }
}