elasticsearch - 如何在Elasticsearch查询中用具体的日期时间替换 “now”？

Question

我想用以下查询中的datetime now代替2017-02-17T15:02:00:

POST /myindex/_search
{
  "size": 0,
"aggs": {
    "range": {
        "date_range": {
            "field": "Datetime",
            "ranges": [
                { "to": "now-1H/H" }, 
                { "from": "now/H" } 
            ]
        }
    }
}
}

如果我直接用 now代替 2017-02-17T15:02:00，那么查询将失败，并显示以下错误:

type": "illegal_argument_exception", "reason": "Unrecognized chars at the end of [2017-02-17T15:02:00/H]: [/H]"

另外，如何指定小时的四分之一而不是1H？

Answer 1

date math doc指出

The expression starts with an anchor date, which can either be now, or a date string ending with ||.

这意味着在您的示例中，您必须用 now替换 2017-02-17T15:02:00||
试试 { "to": "2017-02-17T15:02:00||-1H/H" }
要指定一刻钟，请改为使用分钟符号: { "to": "2017-02-17T15:02:00||-15m/H" }