NEST elasticsearch DateRange query

Question

I am trying to get results from elasticsearch on a predefined range of dates using NEST api but i dont manage. This example code i am trying to retrieve a week of data but it is ignoring my date Filter and returning older data than my initial date.

Thanks in advance for the help!

var node = new Uri("http://localhost:9200");
var settings = new ConnectionSettings(node);
var client = new ElasticClient(settings);

settings.DefaultIndex("wholelog-2017.04*");

client.CreateIndex("wholelog-2017.04*",
create => create.Mappings(
    mappings => mappings.Map<LogLine>(type => 
        type.AutoMap()
        )
        ));

DateTime InitDate = DateTime.Now.AddDays(-7);

var filterClauses = new List<QueryContainer>();

filterClauses.Add(new DateRangeQuery
{
     Field = new Field("logTime"),
     LessThanOrEqualTo = DateTime.Now,
     GreaterThanOrEqualTo = InitDate
});

var searchRequest = new SearchRequest<LogLine>()
{
     Size = 10000,
     From = 0,
     Scroll = "1m",
     Query = new BoolQuery
     {
           Filter = filterClauses
     }
};

var searchResult = client.Search<LogLine>(searchRequest);


[ElasticsearchType(Name="logLine")]
public class LogLine
{
    public string Message {get;set;}
    public DateTime logTime {get;set;}
    public string type {get;set;}
    public string logServer {get;set;}
}

logstash config file

output {
    elasticsearch{
       hosts => "localhost"
       #user => ####
       #password => ####
       index => "wholelog-%{+YYYY.MM.dd}"
    } 
}

Thanks for the help, i added the mapping. It is a POCO class filled automatically. I have tried both DateMath and DateTime with same results. The data is being mapped correctly and i can see by debugging that the objects LogLine are filled correctly. I dont know why the Date query does not work... — seiken

Random Random · Accepted Answer · 2017-04-25T03:01:40

I assume that you didn't explicitly put your mapping and just started adding documents to your index. Try to create a new index like this

client.CreateIndex(indexName,
    create => create.Mappings(
        mappings => mappings.Map<LogLine>(
            type => type.AutoMap()
        )
    )
);

And use DateTime for your field. DateMath is intended for building search queries

[ElasticsearchType(Name = "logLine")]
public class LogLine
{
    public string Message { get; set; }
    public DateTime logTime { get; set; }
    public string type { get; set; }
    public string logServer { get; set; }
}

After explicitly putting your mapping try to add docs and search against new index.

NEST elasticsearch DateRange query

1 Answers