Elasticsearch-dsl-py: How to create range filter

[garyelephant]

I want this:

"range": {
          "@timestamp": {
            "gte": "2014-12-3T16:00:00",
            "lte": "now"
          }
  }

but this code does different thing:

s = Search( using=client, index="my_index" )
s = s.filter( 'range', gte='now-1h', lte='now', field='@timestamp' )
 "range": {
          "field": "@timestamp", 
          "gte": "now-1h", 
          "lte": "now"
 }

@timestamp is put in the wrong place, how to correct it?

[garyelephant]

is this the only way ?

f = F({'range':{'@timestamp':{'gte':'now-1h','lte':'now'}}})
s = s.filter( f )

[HonzaKral]

You can use several ways - anything accepted by F can also be passed in to .filter(), you can also use the **{'@timestamp': {...}} notation like this:

s = s.filter('range', **{'@timestamp': {'gte': ...}})

[garyelephant]

Can elasticsearch-dsl create this nested structure automatically by pass simple params something like

s.filter( 'range', '@timestamp', gte='...', lte='...') 

[amitpandita]

Hey @garyelephant as far as i understand you are trying to implement a range filter in dsl. You can do something like this:

s.filter('range', **{field_name: {"from": from_date, "to": to_date}})

In case you are trying to input the field name and date ranges from variables.

You can also replace lte and gte instead of from and to

[HonzaKral]

Hmm, I like this approach for simple things but I am not sure it will be still clear for more complex structure and it might lead to confusion there - for example what if the structure is even more nested - either has multiple levels or multiple keys?

The biggest advantage of the current approach, as I see it, is that it's absolutely straightforward to use based on the JSON DSL (which is described in the elasticsearch docs) and no additional knowledge is needed, this might bring in more indirection.

I will leave the ticket open for now so we can have a discussion here and decide what we should do here.

[HonzaKral]

I still don't see how we could implement this consistently so I am closing the ticket.