ElasticSearch : How to query a date field using an hours-range filter

When performing date range queries in Elasticsearch, you can achieve precise hour-based time filtering using the range query. The following example demonstrates how to use Elasticsearch's DSL (Domain-Specific Language) to query a specific date field and return only documents within a specific hourly range.

Scenario Setup

Assume we have an index called events that stores documents with a date field event_time recording the time of the event. We now want to query all events that occurred between 2021-03-10 at 14:00 and 16:00.

Query Statement

json
GET /events/_search
{
  "query": {
    "range": {
      "event_time": {
        "gte": "2021-03-10T14:00:00",
        "lte": "2021-03-10T16:00:00",
        "format": "yyyy-MM-dd'T'HH:mm:ss"
      }
    }
  }
}

Detailed Explanation

1. GET /events/_search: This line instructs Elasticsearch to search documents within the events index.
2. query: This defines the query condition.
3. range: The range query allows specifying a time window to filter the event_time field.
   • event_time: This is the date field being filtered.
   • gte (greater than or equal to): Sets the start time (inclusive), here 2021-03-10T14:00:00.
   • lte (less than or equal to): Sets the end time (inclusive), here 2021-03-10T16:00:00.
   • format: Specifies the time format, here the ISO 8601 standard.

By executing this query, Elasticsearch returns all events documents within the 2021-03-10 14:00 to 16:00 time window. This query is highly useful for analyzing data within specific time windows, such as user behavior analysis or system monitoring events.

Use Cases

For example, if you are a data analyst for an e-commerce platform, you might need to identify user purchase behavior during a specific hour of a promotional event to evaluate the promotion's effectiveness. Using this query helps you quickly pinpoint the time range of interest, enabling efficient data analysis and decision support.