Elasticsearch SQL offers a wide range of facilities for performing date/time manipulations.
A common requirement when dealing with date/time in general revolves around
the notion of interval
, a topic that is worth exploring in the context of Elasticsearch and Elasticsearch SQL.
Elasticsearch has comprehensive support for date math both inside index names and queries.
Inside Elasticsearch SQL the former is supported as is by passing the expression in the table name, while the latter is supported through the standard SQL INTERVAL
.
The table below shows the mapping between Elasticsearch and Elasticsearch SQL:
Elasticsearch | Elasticsearch SQL |
Index/Table datetime math | |
| |
Query date/time math | |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
INTERVAL
allows either YEAR
and MONTH
to be mixed together or DAY
, HOUR
, MINUTE
and SECOND
.
Elasticsearch SQL accepts also the plural for each time unit (e.g. both YEAR
and YEARS
are valid).
Example of the possible combinations below:
Interval | Description |
| 1 year and 2 months |
| 3 days and 4 hours |
| 5 days, 6 hours and 12 minutes |
| 3 days, 4 hours, 56 minutes and 1 second |
| 2 days, 3 hours, 45 minutes, 1 second and 234567890 nanoseconds |
| 123 hours and 45 minutes |
| 65 hours, 43 minutes, 21 seconds and 12300000 nanoseconds |
| 45 minutes, 1 second and 230000000 nanoseconds |
Basic arithmetic operators (+
, -
, etc) support date/time parameters as indicated below:
SELECT INTERVAL 1 DAY + INTERVAL 53 MINUTES AS result; result --------------- +1 00:53:00.0
SELECT CAST('1969-05-13T12:34:56' AS DATETIME) + INTERVAL 49 YEARS AS result; result -------------------- 2018-05-13T12:34:56Z
SELECT - INTERVAL '49-1' YEAR TO MONTH result; result --------------- -49-1
SELECT INTERVAL '1' DAY - INTERVAL '2' HOURS AS result; result --------------- +0 22:00:00.0
SELECT CAST('2018-05-13T12:34:56' AS DATETIME) - INTERVAL '2-8' YEAR TO MONTH AS result; result -------------------- 2015-09-13T12:34:56Z
SELECT -2 * INTERVAL '3' YEARS AS result; result --------------- -6-0
Synopsis:
CURRENT_DATE CURRENT_DATE() CURDATE()
Input: none
Output: date
Description: Returns the date (no time part) when the current query reached the server.
It can be used both as a keyword: CURRENT_DATE
or as a function with no arguments: CURRENT_DATE()
.
Unlike CURRENT_DATE, CURDATE()
can only be used as a function with no arguments and not as a keyword.
This method always returns the same value for its every occurrence within the same query.
SELECT CURRENT_DATE AS result; result ------------------------ 2018-12-12
SELECT CURRENT_DATE() AS result; result ------------------------ 2018-12-12
SELECT CURDATE() AS result; result ------------------------ 2018-12-12
Typically, this function (as well as its twin TODAY()) function is used for relative date filtering:
SELECT first_name FROM emp WHERE hire_date > TODAY() - INTERVAL 35 YEARS ORDER BY first_name ASC LIMIT 5; first_name ------------ Alejandro Amabile Anneke Anoosh Arumugam
Synopsis:
Input:
Output: date/time
Description: Returns the date/time when the current query reached the server.
As a function, CURRENT_TIMESTAMP()
accepts precision as an optional
parameter for rounding the second fractional digits (nanoseconds). The default precision is 3,
meaning a milliseconds precision current date/time will be returned.
This method always returns the same value for its every occurrence within the same query.
SELECT CURRENT_TIMESTAMP AS result; result ------------------------ 2018-12-12T14:48:52.448Z
SELECT CURRENT_TIMESTAMP() AS result; result ------------------------ 2018-12-12T14:48:52.448Z
SELECT CURRENT_TIMESTAMP(1) AS result; result ------------------------ 2018-12-12T14:48:52.4Z
Typically, this function (as well as its twin NOW()) function is used for relative date/time filtering:
SELECT first_name FROM emp WHERE hire_date > NOW() - INTERVAL 100 YEARS ORDER BY first_name ASC LIMIT 5; first_name --------------- Alejandro Amabile Anneke Anoosh Arumugam
Currently, using a precision greater than 3 doesn’t make any difference to the output of the function as the maximum number of second fractional digits returned is 3 (milliseconds).
Synopsis:
Input:
Output: integer
Description: Extract the day of the month from a date/datetime.
SELECT DAY_OF_MONTH(CAST('2018-02-19T10:23:27Z' AS TIMESTAMP)) AS day; day --------------- 19
Synopsis:
Input:
Output: integer
Description: Extract the day of the week from a date/datetime. Sunday is 1
, Monday is 2
, etc.
SELECT DAY_OF_WEEK(CAST('2018-02-19T10:23:27Z' AS TIMESTAMP)) AS day; day --------------- 2
Synopsis:
Input:
Output: integer
Description: Extract the day of the year from a date/datetime.
SELECT DAY_OF_YEAR(CAST('2018-02-19T10:23:27Z' AS TIMESTAMP)) AS day; day --------------- 50
Synopsis:
Input:
Output: string
Description: Extract the day of the week from a date/datetime in text format (Monday
, Tuesday
…).
SELECT DAY_NAME(CAST('2018-02-19T10:23:27Z' AS TIMESTAMP)) AS day; day --------------- Monday
Synopsis:
Input:
Output: integer
Description: Extract the hour of the day from a date/datetime.
SELECT HOUR_OF_DAY(CAST('2018-02-19T10:23:27Z' AS TIMESTAMP)) AS hour; hour --------------- 10
Synopsis:
Input:
Output: integer
Description: Extract the day of the week from a date/datetime, following the ISO 8601 standard.
Monday is 1
, Tuesday is 2
, etc.
SELECT ISO_DAY_OF_WEEK(CAST('2018-02-19T10:23:27Z' AS TIMESTAMP)) AS day; day --------------- 1
Synopsis:
Input:
Output: integer
Description: Extract the week of the year from a date/datetime, following ISO 8601 standard. The first week of a year is the first week with a majority (4 or more) of its days in January.
SELECT ISO_WEEK_OF_YEAR(CAST('2018-02-19T10:23:27Z' AS TIMESTAMP)) AS week; week --------------- 8
Synopsis:
Input:
Output: integer
Description: Extract the minute of the day from a date/datetime.
SELECT MINUTE_OF_DAY(CAST('2018-02-19T10:23:27Z' AS TIMESTAMP)) AS minute; minute --------------- 623
Synopsis:
Input:
Output: integer
Description: Extract the minute of the hour from a date/datetime.
SELECT MINUTE_OF_HOUR(CAST('2018-02-19T10:23:27Z' AS TIMESTAMP)) AS minute; minute --------------- 23
Synopsis:
Input:
Output: integer
Description: Extract the month of the year from a date/datetime.
SELECT MONTH_OF_YEAR(CAST('2018-02-19T10:23:27Z' AS TIMESTAMP)) AS month; month --------------- 2
Synopsis:
Input:
Output: string
Description: Extract the month from a date/datetime in text format (January
, February
…).
SELECT MONTH_NAME(CAST('2018-02-19T10:23:27Z' AS TIMESTAMP)) AS month; month --------------- February
Synopsis:
NOW()
Input: none
Output: datetime
Description: This function offers the same functionality as CURRENT_TIMESTAMP() function: returns the datetime when the current query reached the server. This method always returns the same value for its every occurrence within the same query.
SELECT NOW() AS result; result ------------------------ 2018-12-12T14:48:52.448Z
Typically, this function (as well as its twin CURRENT_TIMESTAMP()) function is used for relative date/time filtering:
SELECT first_name FROM emp WHERE hire_date > NOW() - INTERVAL 100 YEARS ORDER BY first_name ASC LIMIT 5; first_name --------------- Alejandro Amabile Anneke Anoosh Arumugam
Synopsis:
Input:
Output: integer
Description: Extract the second of the minute from a date/datetime.
SELECT SECOND_OF_MINUTE(CAST('2018-02-19T10:23:27Z' AS TIMESTAMP)) AS second; second --------------- 27
Synopsis:
Input:
Output: integer
Description: Extract the year quarter the date/datetime falls in.
SELECT QUARTER(CAST('2018-02-19T10:23:27Z' AS TIMESTAMP)) AS quarter; quarter --------------- 1
Synopsis:
TODAY()
Input: none
Output: date
Description: This function offers the same functionality as CURRENT_DATE() function: returns the date when the current query reached the server. This method always returns the same value for its every occurrence within the same query.
SELECT TODAY() AS result; result ------------------------ 2018-12-12
Typically, this function (as well as its twin CURRENT_TIMESTAMP()) function is used for relative date filtering:
SELECT first_name FROM emp WHERE hire_date > TODAY() - INTERVAL 35 YEARS ORDER BY first_name ASC LIMIT 5; first_name ------------ Alejandro Amabile Anneke Anoosh Arumugam
Synopsis:
Input:
Output: integer
Description: Extract the week of the year from a date/datetime.
SELECT WEEK(CAST('1988-01-05T09:22:10Z' AS TIMESTAMP)) AS week, ISOWEEK(CAST('1988-01-05T09:22:10Z' AS TIMESTAMP)) AS isoweek; week | isoweek ---------------+--------------- 2 |1
Synopsis:
Input:
Output: integer
Description: Extract the year from a date/datetime.
SELECT YEAR(CAST('2018-02-19T10:23:27Z' AS TIMESTAMP)) AS year; year --------------- 2018
Synopsis:
Input:
Output: integer
Description: Extract fields from a date/datetime by specifying the name of a datetime function. The following
SELECT EXTRACT(DAY_OF_YEAR FROM CAST('2018-02-19T10:23:27Z' AS TIMESTAMP)) AS day; day --------------- 50
is the equivalent to
SELECT DAY_OF_YEAR(CAST('2018-02-19T10:23:27Z' AS TIMESTAMP)) AS day; day --------------- 50