GET forensics/_search
{
"size": 1,
"query": {
"bool": {
"must": [
{
"range": {
"@timestamp": {
"gte": "now-1d/d",
"lte": "now"
}
}
}
]
},
"sort" : [
{ "@timestamp" : {"order" : "asc"}}
]
}
}