Kibana: How do I exclude results if two timestamps nearly match-CodePudding

I got two timestamps which - if they are nearly (base 5 Minutes) the same - I like to exclude from the results:

"base.timestamp": [
  "2023-01-03T22:46:29.946Z"

"open.timestamp": [
  "2023-01-03T22:51:21.025Z"

So if the open.timestamp is within 5 Minutes of the base.timestamp. I do not want to include the results.

Thanks a lot! :)

CodePudding user response：

Let consider below is your sample data in Elasticsearch: Two documents have more then 5 minutes diffrents.

{
        "_index": "75003109",
        "_id": "y8C2gYUBeO1nh7Fpx-u1",
        "_score": 1,
        "_source": {
          "base.timestamp": "2023-01-03T22:46:29.946Z",
          "open.timestamp": "2023-01-03T22:51:21.025Z"
        }
      },
      {
        "_index": "75003109",
        "_id": "zMC2gYUBeO1nh7Fp5evk",
        "_score": 1,
        "_source": {
          "base.timestamp": "2023-01-03T22:40:29.946Z",
          "open.timestamp": "2023-01-03T22:51:21.025Z"
        }
      },
      {
        "_index": "75003109",
        "_id": "zcC2gYUBeO1nh7Fp_OsH",
        "_score": 1,
        "_source": {
          "base.timestamp": "2023-01-03T22:48:29.946Z",
          "open.timestamp": "2023-01-03T22:51:21.025Z"
        }
      },
      {
        "_index": "75003109",
        "_id": "zsC3gYUBeO1nh7FpHut5",
        "_score": 1,
        "_source": {
          "base.timestamp": "2023-01-03T22:38:29.946Z",
          "open.timestamp": "2023-01-03T22:51:21.025Z"
        }
      }

You can use below query:

{
  "query": {
    "bool": {
      "filter": [
        {
          "script": {
            "script": {
              "source": "doc['open.timestamp'].value.toInstant().toEpochMilli() - doc['base.timestamp'].value.toInstant().toEpochMilli() >=300000"
            }
          }
        }
      ]
    }
  }
}

Above query will return below response:

{
        "_index": "75003109",
        "_id": "zMC2gYUBeO1nh7Fp5evk",
        "_score": 0,
        "_source": {
          "base.timestamp": "2023-01-03T22:40:29.946Z",
          "open.timestamp": "2023-01-03T22:51:21.025Z"
        }
      },
      {
        "_index": "75003109",
        "_id": "zsC3gYUBeO1nh7FpHut5",
        "_score": 0,
        "_source": {
          "base.timestamp": "2023-01-03T22:38:29.946Z",
          "open.timestamp": "2023-01-03T22:51:21.025Z"
        }
      }