Elastic relative data math - finding all things today

Question

I'm trying to do so fairly simple query with Elasticsearch, but I don't think I understand what I'm doing wrong, so I'm posting here for some pointers.

I have an elastic index where each document has a date like so:

{
  // edited for brevity
  "releasedate": "2020-10-03T15:55:03+00:00",
}

and I am using django DRF to make queries like so, where I pass this value along &releasedate__gt=now-3d/d

Which ends up with an elastic range query like this.

{
  
  "from": 0,
  "query": {
    "bool": {
      "filter": [
        {
          "range": {
            "releasedate": {
              "gt": "now/d-3d"
            }
          }
        }
        ]
    }
  },
  "size": 10,
  "sort": [
    "_score"
  ]
}

If I want to see all "documents since yesterday", I think of it in terms of all documents with releasedate greater than midnight yesterday, I figured the key part of the query would need to be like so:

{
  "query": {
    "bool": {
      "filter": [
        {
          "range": {
            "releasedate": {
              "gt": "now/d-1d"
            }
          }
        }
        ]
    }
  }
}

So I expect this would round the time now, to 00:00 today, then go back one day.

So if I ran this on 2020-10-04. I'd assume this would catch a document with the release date of 2020-10-03T15:55:03+00:00.

Here's my reasoning

Rounding down with now/d would take us to 2020-10-04T00:00.

And then going back one day with -1d would take us to 2020-10-03T00:00.

This ought to include the document, but I'm not seeing it. I need to look back more than one day to find the documents, so I need to use now/d-2d to find matching documents.

Any idea why this might be? I'm unsure of how to see what now/d-1d evaluates in terms of a timezone aware object, to check - that's what I might reach for, but I don't know how with Elastic.

FWIW, this is using Elastic 5.6. We'll be updating soon.

Answer 1

I'd say that once you round down to the nearest day (either with now-2d/d or now/d-2d -- as you did), the gt query's intervals will indeed be day-based.

In other words, gt : 2020-10-03T00:00 is >= 2020-10-04T00:00. So what you need instead of gt is gte and that'll work as >=2020-10-03T00:00.