I have a .Net application trying to fetch data from an elasticsearch document store, having records in the following structure:
{
"_index": "TestIndex",
"_type": "amqp",
"_id": "123",
"_source": {
"@timestamp": "2014-10-27T01:31:54.780Z",
"type": "amqp",
"LogGenerationTime": "2014-10-26T21:31:54.780",
"ThreadID": "6",
"ProcessID": "8136",
"SessionID": "xyz",
"UserID": "12345678",
},
}
I want to fetch all the records with LogGenerationTime in the last 20 mins. Here's the query that I have written so far but it does not seem to return any data:
var format = "yyyy-MM-dd'T'HH:mm:ss.fff";
var lowerBound = DateTime.Now.AddMinutes(-20);
ISearchResponse<Amqp> resultSet = _elasticSearchClient.Search<Amqp>(q => q.Query
(p => p.Range
(v => v.OnField
(x => x.LogGenerationTime).GreaterOrEquals(lowerBound, format))));
Can someone please help write the correct query to fetch expected results? Thanks!
Looking at the source code, there are two overloads of the OnField method. When I use the the that takes Linq expression parameter, the query does not return any data. But I was able to make it work with the other overload, which takes string value, where I am passing the field name of the elasticsearch document as a string. Here's the query that returns expected results:
var resultSet = _elasticSearchClient.Search<Amqp>(q => q.Query
(p => p.Range(v => v.OnField("LogGenerationTime").GreaterOrEquals(lowerBound))).Size(10000));
Looks like a bug in the framework but am not completely sure.