elasticsearch - 如何从 Elasticsearch 中获取最近 30 分钟的记录

Question

I am using following query to fetch all last 30 minutes records using elastic search, but I'm getting parsable error on line "now-30m".



    Query: 
{

  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "appName": "magnus-alerting-system"
          }
        },
        {
          "match": {
            "countryCode": "US2"
          }
        },
        {
          "match": {
            "eventCode": 201
          }
        },
        {
          "match": {
            "extractName": "LaborDemand"
          }
        },{
          "range": {
            "eventPostTimestamp": {
              **"gte": "now()-30m"**
            }
          }
        }

      ]
    }
  }
}

执行服务时 postman 出错:
“根本原因”: [
{
"type": "number_format_exception",
"reason": "对于输入字符串:\"now()-30m\""
}
]

请让我知道如何纠正它。

Answer 1

原因是因为 Elasticsearch 中的 now()-30m 是错误的，因为正确的格式只是“现在”。
Documentation

因此正确的查询如下:

{
  "query": {
    "bool": {
      "must": [
        {
          "match": {
            "appName": "magnus-alerting-system"
          }
        },
        {
          "match": {
            "countryCode": "US2"
          }
        },
        {
          "match": {
            "eventCode": 201
          }
        },
        {
          "match": {
            "extractName": "LaborDemand"
          }
        },{
          "range": {
          "eventPostTimestamp": {
          "gte": "now-30m"
            }
          }
        }

      ]
    }
  }
}