elasticsearch match only date of date field - elasticsearch

Following is the mapping for date field in elasticsearch index
persons:{
"dob":{
"type": "date",
"format": "yyyy-MM-dd"
}
}
Now I want to search all the persons whose birthday is on 5th of any month.
Thanks in advance.

you can do that without reindexing! With a reindex of a date in text field, you can't search with range query against that field anymore. The best practice is to use a painless script doc['dob'].date.dayOfMonth Take a look here: https://www.elastic.co/guide/en/elasticsearch/reference/master/modules-scripting-expression.html#_date_field_api

So, with above solutions help. I made the query this way
"script_fields": {
"isDOBMatch": {
"script": {
"lang":"painless",
"inline": "doc.dob.date.dayOfMonth==params.dob_match_vals",
"params": {
"dob_match_vals": [**pass the value which u want to match**]
}
}
}
}
The above query returns true/false value.

Related

Getting a specific date in elasticsearch?

I have searched a lot of sites. This code is given. But by writing this all the entries containing "2021" are displayed when I need only the entries having date as "10-10-2021". pls guide what to do
{ "query": { "term": { "date": { "value": "10-10-2020" } } } }
Is your field indexed as a date or a keyword? Index it as a date and instead of a terms query you should use a range query to get documents within a specific span of time: https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-range-query.html

ElasticSearch query text

My index data is
{
"full_name":"Edwin Powell Hubble",
"job": "IT"
}
{
"full_name":"John Edwin",
"job": "Accountant"
}
{
"first_name":"Eric Petterson",
"job": "Accountant"
}
I am not sure if anyone could help me to build a query to get data that have full_name as Edwin. It tried with term query seem not really work.
Since full_name can be of any length and should be analyzed when indexed, I believe you have mapped the attribute as of type text.
For the same reason I also believe you will have requirements to return results as 'Edwin Powell Hubble' and 'John Edwin' when searched with 'Edwin' and return 'Edwin Powell Hubble' when search with 'Edwin Pow'
match_phrase_prefix should help you with these use cases.
GET /_search
{
"query": {
"match_phrase_prefix": {
"full_name": "Edwin"
}
}
}
You can use the match query to get data that have full_name as Edwin
{
"query": {
"match": {
"full_name": "edwin"
}
}
}
Term query works on exact text match, so you will not get any document for Edwin since there is no data in your sample index data that have a match for full_name as Edwin

Filtering documents by an unknown value of a field

I'm trying to create a query to filter my documents by one (can be anyone) value from a field (in my case "host.name"). The point is that I don't know previously the unique values of this field. I need found these and choose one to be used in the query.
I had tried the below query using a painless script, but I have not been able to achieve the goal.
{
"sort" : [{"#timestamp": "desc"}, {"host.name": "asc"}],
"query": {
"bool": {
"filter": {
"script": {
"script": {
"source": """
String k = doc['host.name'][0];
return doc['host.name'].value == k;
""",
"lang": "painless"
}
}
}
}
}
I'll appreciate if any can help me improving this idea of suggesting me a new one.
TL;DR you can't.
The script query context operates on one document at a time and so you won't have access to the other docs' field values. You can either use a scripted_metric aggregation which does allow iterating through all docs but it's just that -- an aggregation -- and not a query.
I'd suggest to first run a simple terms agg to figure out what values you're working with and then build your queries accordingly.

ElasticSearch - Access array of date_range in painless script filter

Is there any way to access an array of date_range in a painless script filter?
My mapping for the "blocked_dates" field is as follows:
"blocked_dates": {
"type": "date_range",
"format": "strict_date"
},
Data looks like this:
"blocked_dates": [
{
"gte": "2019-07-12",
"lte": "2019-07-14"
},
{
"gte": "2019-07-16",
"lte": "2019-07-18"
}
],
I am using Amazon ElasticSearch v6.7 so I cannot use params._source in a script filter and if I try and access it via doc then I get an illegal_argument_exception.
"blocked_dates = doc['blocked_dates'].value; ",
" ^---- HERE"
Fielddata is not supported on field [blocked_dates] of type [date_range]
I have a complex booking window requirement that checks if the chosen move-in and move-out date is within x days of another booking (blocked date) and this has to be done in a script.
I could do something hacky like store a copy of the array of date_range as a comma delimited (ie "2019-07-20,2019-09-12") string array. Then grab the string array from the painless script filter and parse the dates out of them.
But that is my last resort.
Try params._source.blocked_dates.gte (or lte depends on your needs), but keep in mind what it returned string, but not a date in your particular case.
In my case (float_range) solution was
"script": {
"lang": "painless",
"source": "Float.parseFloat(params._source.price.gte)"
}
I think idea is pretty clear

Can Elasticsearch filter by a date range without specifying a field?

I have multiple date fields and I want to have a single date range query to filter by any of them.
For example, I may have books in my index, and each book may have a published date, edition date, print date, and the author's birth date.
The mapping is straightforward (generated using Elasticsearch.net Nest):
"printDate" : {
"type" : "date",
"format" : "strict_date_optional_time||epoch_millis"
},
I looked at range queries and query string ranges - both need the name of the field explicitly and don't seem to support wildcards.
For example, this doesn't find anything, but works if I use a real field name instead of "*Date":
"filter": [
{
"range": {
"*Date": {
"gte": "2010-01-01T00:00:00",
"lte": "2015-01-01T00:00:00"
}
}
}
]
I also tried placing [2010-01-01 TO 2015-01-01] in a query string, but the dates aren't parsed correctly - it also finds 2010 or 01 as part of other strings (and seemingly other dates).
Another option is to list each field under a "should" clause and specifying "minimum_should_match":1, but that will make me maintain a list of all date fields, which seems inelegant.
Is there a way of searching for a date range on all date fields?
Try this query:
{
"query": {
"query_string": {
"default_field": "*Date",
"query": "[2010-01-01T00:00:00 TO 2015-01-01T00:00:00]"
}
}
}

Resources