ElasticSearch requests range timestamp in python

Question

I'm trying to perform a request on my ES, to count logs in a timestamp range. My request works, but she returns always the same result. The timestamp filter seems not working. I would to retrieve a facet by status_code for my servertest01 in a custom timestamp range.

import rawes
from datetime import datetime
from dateutil import tz
paristimezone = tz.gettz('Europe/Paris')

es = rawes.Elastic('127.0.0.1:9200')

result = es.get('/_search', data={
    "query" : { "match_all" : {}
              },
    "filter": {
        "range": {
           "@timestamp": {
              "from": datetime(2013, 3, 11, 8, 0, 30,   tzinfo=paristimezone),
               "to": datetime(2013, 3, 12, 11, 0, 30, tzinfo=paristimezone)}
                  }
           },
   "facets" : {
       "error" : {
        "terms" : {
            "field" : "status_code"
        },
         "facet_filter" : {
            "term" : {"server" : "testserver01"}
           }
        }
    }
})

print(result['facets'])

And in my ES data, the timestamp field is like this:

"@timestamp":"2013-03-12T00:02:29+01:00"

Thanks :)

Answer 1

The filter element in the search API is used to filter query results AFTER facets have been calculated.

If you want to apply the filter both to the query and to the facets, then you should use a filtered query instead:

result = es.get('/_search', data={
    "query": {
        "filtered": {
            "query" : { "match_all" : {}},
            "filter": {
                "range": {
                   "@timestamp": {
                      "from": datetime(2013, 3, 11, 8, 0, 30,   tzinfo=paristimezone),
                       "to": datetime(2013, 3, 12, 11, 0, 30, tzinfo=paristimezone)
                    }
                }
            }
        }
    },           
   "facets" : {
       "error" : {
        "terms" : {
            "field" : "status_code"
        },
         "facet_filter" : {
            "term" : {"server" : "testserver01"}
           }
        }
    }
})