Elasticsearch单日期时间字段实现日期与时间分离搜索的问题及方案咨询

Let's tackle your two questions with clear explanations and actionable solutions, based on your provided setup and queries.

1. Why can't I search by time range alone? #

The root cause here lies in how Elasticsearch parses date fields. Your start_time is mapped as a date type (even if you didn't explicitly define it, Elasticsearch auto-mapped it using the default strict_date_optional_time||epoch_millis format).

This format expects input values to fall into one of these categories:

• A full date-time string (like 2021-12-13T06:57:29.420198Z),
• A date-only string (like 2021-12-13, which Elasticsearch treats as 2021-12-13T00:00:00Z),
• Or an epoch millisecond timestamp.

When you pass just a standalone time string like 6:57:29, Elasticsearch has no way to associate it with a valid date—there's no year/month/day context to turn that time into a valid date value. That's exactly why you get the parsing error: it can't fit your time-only input into the required format.

2. How to combine date and time searches using the single start_time field? #

There are a few reliable, flexible ways to achieve this, depending on your use case:

Option 1: Use a Script Query for Precise Time Filtering #

You can directly filter the time component in a script query while using the range query for dates. First, fix your script syntax—you had a redundant start_time in doc.start_time.start_time; it should just be doc.start_time to access the date field.

Here's the corrected, precise query:

{
  "query": {
    "bool": {
      "must": [
        { "match": { "customers": "Jerry" } },
        { "match": { "name": "Tom" } },
        { "range": { "start_time": { "gte": "2021-12-13", "lte": "2021-12-15" } } },
        {
          "script": {
            "source": """
              def hour = doc['start_time'].value.getHourOfDay();
              def minute = doc['start_time'].value.getMinute();
              def second = doc['start_time'].value.getSecond();
              // Convert time to total seconds since midnight for accurate range checks
              def totalSeconds = hour * 3600 + minute * 60 + second;
              return totalSeconds >= params.minSeconds && totalSeconds <= params.maxSeconds;
            """,
            "params": {
              "minSeconds": 6 * 3600 + 57 * 60 + 29, // 6:57:29 in seconds
              "maxSeconds": 7 * 3600 + 0 * 60 + 0   // 7:00:00 in seconds
            }
          }
        }
      ]
    }
  }
}

This approach lets you separate date and time filters dynamically, without modifying your index mapping.

Option 2: Add Runtime Fields for Reusable Time Components #

If you want to reuse time-based filters across multiple queries, define runtime fields to extract hour, minute, or full time strings from start_time. This avoids repeating script logic and makes queries cleaner.

First, update your index mapping with these runtime fields:

{
  "settings": {
    "number_of_shards": 2,
    "number_of_replicas": 1
  },
  "mappings": {
    "dynamic": "true",
    "_source": { "enabled": true },
    "runtime": {
      "start_time_hour": {
        "type": "long",
        "script": "emit(doc['start_time'].value.getHourOfDay())"
      },
      "start_time_full_time": {
        "type": "keyword",
        "script": "emit(doc['start_time'].value.format('HH:mm:ss'))"
      }
    },
    "properties": {
      "name": { "type": "keyword" },
      "customers": { "type": "text" },
      "start_time": { "type": "date" } // Explicitly define date type for clarity
    }
  }
}

Now you can query using these runtime fields alongside your date range:

{
  "query": {
    "bool": {
      "must": [
        { "match": { "customers": "Jerry" } },
        { "range": { "start_time": { "gte": "2021-12-13", "lte": "2021-12-15" } } },
        { "range": { "start_time_hour": { "gte": 6, "lte": 7 } } },
        // Or use the full time string for precise minute/second filtering:
        { "range": { "start_time_full_time": { "gte": "06:57:29", "lte": "07:00:00" } } }
      ]
    }
  }
}

Note: Runtime fields are computed at query time, so they don't add storage overhead but may have a small performance impact compared to pre-indexed fields.

Option 3: Combine Date and Time in a Single Range Query #

If you know the exact date-time range you want to filter, the simplest approach is to use full date-time strings directly in the range query for start_time:

{
  "query": {
    "bool": {
      "must": [
        { "match": { "customers": "Jerry" } },
        { "range": {
          "start_time": {
            "gte": "2021-12-13T06:57:29",
            "lte": "2021-12-13T07:00:23"
          }
        }
      ]
    }
  }
}

This works great if you don't need to separate date and time filters dynamically.

内容的提问来源于stack exchange，提问作者DmUser