Search code examples
regexelasticsearchelasticsearch-dslelastalert

Timestamp regexp in Elasticsearch

My goal is to make an alert in ElastAlert for this scenario: no events has occured between midnight and 2 am. (for any date). The problem is how to make a query to Elasticsearch that matches any date but a specific time, because you cannot use regexp or wildcard on timestamp of type 'date'. Any suggestions?

This code returns "Parse failure":

"range": {
  "timestamp": {
    "gte": "20[0-9]{2}-[0-9]{2}-[0-9]{2}T00:00:00.000Z",
    "lt": "20[0-9]{2}-[0-9]{2}-[0-9]{2}T02:00:00.000Z"
  }
}
Solution

  • I didn't have the right to write custom rules, so my solution was to make changes in logstash. Added the field hour_of_day, where the value is derived from the timestamp. Thus we are able to create a flatline rule with a filter like this:

    filter:
 - query:
      query_string:
        query: "hour_of_day: 0 OR hour_of_day: 1"