Mushka has asked for the wisdom of the Perl Monks concerning the following question:

Hello Gurus and Newcomers of THE LANGUAGE! Seeking your wisdom and help with Search::Elasticsearch module... I was actually very surprised to see no questions about this given limited Perl docs on the matter.

I am trying to match the log dates AND filter or search by time as well. The following works as expected giving me first 3 lines from the log for a given date:

my $es = Search::Elasticsearch->new( nodes => 'logs.server.local:9200', cxn_pool => 'Sniff', ## "web servers and Elasticsearch server +s are on the same network" ); my $results = $es->search( body => { query => { filtered => { query => { term => { component=> 'ens_iis' } }, filter => { and => [ { term => { date=> '2014-04-22' } }, ], }, } } }, from => 0, size => 3, timeout => 60, );

However for the life of me i cannot get the time filter to work! I tried various different ways and either get incorrect results or none at all. Here's the most logical (in my eyes) attempt of such search that does NOT work:

my $results = $es->search( body => { query => { filtered => { query => { term => { component=> 'ens_iis' } }, filter => { and => [ { term => { date=> '2014-04-22' } }, { range => { time => { gte => '02:00:00', lt => '07:55:00' } } }, ], }, } } }, from => 0, size => 3, timeout => 60, );

This returns the same rows as without the filter with timestamps starting 00:03:56. I tried various ways to escape the timestamps but without expected results.

Im not sure what i am missing here and will be grateful for any guidance and advice!

Thank you!

Replies are listed 'Best First'.
Re: Search::Elasticsearch need to filter by time
by Mushka (Acolyte) on Apr 27, 2014 at 03:57 UTC
    Any suggestions at all?