Counting with range and terms in Elasticsearch

Question

I'm attempting to do a count query such that I return the number of unsuccessful attempts to log into my system within the last 10 minutes. I created this query:

{
  "term": {
    "success":false
  },
  "range": {
    "_timestamp": {
      "gt": "now-10m"
    }
  }
}

However, this returns all of the unsuccessful attempts for any time, disregarding the range filter in my query. Am I structuring this query correctly? The query works when I do a search with terms and ranges.

In other words, the output of the above query and curl -XGET localhost:9200/application/_count is the same (I have only tested unsuccessful attempts).

J.T. · Accepted Answer · 2013-09-30 14:26:26Z

1

Try using the search_type parameter instead of using the countAPI. This is actually preferred:

curl -XGET localhost:9200/application/_search&search_type=count -d'{
    query:....
}'

Documentation: http://www.elasticsearch.org/guide/reference/api/search/search-type/

answered Sep 30, 2013 at 14:26

J.T.

2,62618 silver badges32 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

mguillermin · Accepted Answer · 2013-09-28 12:29:15Z

0

The range is a filter, so I think you have to create a filtered query to take it correctly into account :

{
  "filtered": {
    "query": {
      "term": {
        "success":false
      },
    },
    "filter: {
      "range": {
        "_timestamp": {
          "gt": "now-10m"
        }
      }
    }
  }
}

edited Sep 28, 2013 at 12:29

answered Sep 28, 2013 at 11:51

mguillermin

4,18122 silver badges26 bronze badges

3 Comments

josh Over a year ago

This doesn't work and still gives me output of count: 4, the same as a GET request to localhost:9200/application/_count

mguillermin Over a year ago

I think I get it. The range is only a filter. You have to use a filtered query. I will update my answer.

josh Over a year ago

Same issue... :( I was able to successfully get the correct results during a search query with my parameters, but count will not accept them and only goes after term.

Collectives™ on Stack Overflow

Counting with range and terms in Elasticsearch

2 Answers 2

Comments

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related