I have below similar logs.
I have created dummy index
and created mapping
like below in dev-tools
PUT new
{
"mappings": {
"properties": {
"@timestamp": {
"type": "date",
"format": "yyyy-MM-dd HH:mm:ss.SSS"
}
}
}
}
and indexed
data as below,
PUT /new/_doc/1
{
"@timestamp": "2021-11-05 08:12:14.534",
"level": "INFO",
"id": "1",
"text": "website is accessed",
"status": "clicked"
}
PUT /new/_doc/2
{
"@timestamp": "2021-10-14 09:11:14.534",
"level": "INFO",
"id": "3",
"text": "website is accessed",
"status": "clicked"
}
PUT /new/_doc/3
{
"@timestamp": "2021-09-09 02:08:20.534",
"level": "INFO",
"id": "4",
"text": "website is accessed",
"status": "clicked"
}
I am able to fetch the total counts using below request
query,
GET new/_search
{
"aggs": {},
"size": 0,
"fields": [],
"query": {
"bool": {
"must": [],
"filter": [
{
"bool": {
"should": [
{
"match_phrase": {
"text": "website is accessed"
}
}
],
"minimum_should_match": 1
}
},
{
"range": {
"@timestamp": {
"gte": "2021-10-01",
"lte": "2021-10-30"
}
}
}
],
"should": [],
"must_not": []
}
}
}
Getting response
as below,
{
"took" : 0,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 1,
"relation" : "eq"
},
"max_score" : null,
"hits" : [ ]
}
}
As you see, i need to hardcode
the date
to fetch the value for a particular month
i.e to fetch the same information for sept
month, I need to modify the date time range
as below in curl request,
"range": {
"@timestamp": {
"gte": "2021-09-01",
"lte": "2021-09-30"
}
}
Below is the curl call request
.
curl -u elastic:xxx -XGET "http://10.10.10.10:9200/new/_search?pretty" -H 'Content-Type: application/json' -d'
{
"aggs": {},
"size": 0,
"fields": [],
"query": {
"bool": {
"must": [],
"filter": [
{
"bool": {
"should": [
{
"match_phrase": {
"text": "website is accessed"
}
}
],
"minimum_should_match": 1
}
},
{
"range": {
"@timestamp": {
"gte": "2021-10-01",
"lte": "2021-10-30"
}
}
}
],
"should": [],
"must_not": []
}
}
}'
How can I pass year
and month
dynamically (i.e without actually hardcoding it request itself) to the curl request which will fetch the information for that particular month
, year
?
update -
I am able to get the results for last month (Nov) or last 2 months (Oct) and so on using below,
last month - Nov
-
"gte": "now-M",
"lt": "now/M"
2 months - Oct
"gte": "now-2M/M",
"lte": "now-2M/M"
But is there way to provide desired year
and month
to retrieve results?
Thanks,