# Can't use @timestamp in WHERE clause

**URL:** <https://discuss.elastic.co/t/cant-use-timestamp-in-where-clause/376517>\
**Category:** Kibana\
**Tags:** canvas\
**Created:** [March 28, 2025, 10:04am UTC](https://discuss.elastic.co/t/cant-use-timestamp-in-where-clause/376517 "2025-03-28T10:04:36Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![JensHaglof](https://avatars.discourse-cdn.com/v4/letter/j/eb8c5e/32.png) [@JensHaglof](https://discuss.elastic.co/u/JensHaglof)\
**Post date:** [March 28, 2025, 10:04am UTC](https://discuss.elastic.co/t/cant-use-timestamp-in-where-clause/376517/1 "2025-03-28T10:04:36Z")

</div>

This query works:

query="  
SELECT  
COUNT(1) as value  
FROM "drs-fija-order"  
WHERE 1 = 1"

This doesn't:

query="  
SELECT  
COUNT(1) as value  
FROM "drs-fija-order"  
WHERE 1 = 1  
and @timestamp \> NOW() - interval 1 hour"

How do I filter using @timestamp?

---

<div class="post-metadata">

**Author:** ![jsanz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsanz/32/53734_2.png) [@jsanz](https://discuss.elastic.co/u/jsanz)\
**Post date:** [March 28, 2025, 12:21pm UTC](https://discuss.elastic.co/t/cant-use-timestamp-in-where-clause/376517/2 "2025-03-28T12:21:06Z")

</div>

Use dobule quotes as in `"@timestamp" - NOW()...`

Tested directly in the Console

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/d/cd634592bcd67b7cb4b08019d8e9006c1314103e.png)

Yields same result as in Discover to me:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/d/7d8bb0557c00896bd5e352070462c67d0de518a1.png)

---

<div class="post-metadata">

**Author:** ![JensHaglof](https://avatars.discourse-cdn.com/v4/letter/j/eb8c5e/32.png) [@JensHaglof](https://discuss.elastic.co/u/JensHaglof)\
**Post date:** [March 28, 2025, 1:01pm UTC](https://discuss.elastic.co/t/cant-use-timestamp-in-where-clause/376517/3 "2025-03-28T13:01:52Z")

</div>

Hi Jorge! Thanks for the reply. 🙂

It didn't work though. This is what I tried:

kibana  
| essql timezone="CET"  
query="  
SELECT  
COUNT(1) as value  
FROM "drs-fija-order"  
WHERE 1 = 1  
and "@timestamp" \> NOW() - interval 1 hour  
"

| math "value"

| metric "Last hour"

metricFont={font align="right" color="#444444" family="'Open Sans', Helvetica, Arial, sans-serif" italic=false size=96 underline=false weight="bold"}

labelFont={font align="left" color="#444444" family="'Open Sans', Helvetica, Arial, sans-serif" italic=false size=36 underline=false weight="normal"} metricFormat="0"

| render

I also tried with double double quotes. ""@timestamp""

---

<div class="post-metadata">

**Author:** ![JensHaglof](https://avatars.discourse-cdn.com/v4/letter/j/eb8c5e/32.png) [@JensHaglof](https://discuss.elastic.co/u/JensHaglof)\
**Post date:** [March 28, 2025, 1:03pm UTC](https://discuss.elastic.co/t/cant-use-timestamp-in-where-clause/376517/4 "2025-03-28T13:03:32Z")

</div>

![image](https://us1.discourse-cdn.com/elastic/original/3X/6/5/65e81d77cd8f078255c938e9c2f886fe4bed3ff6.png)

---

<div class="post-metadata">

**Author:** ![JensHaglof](https://avatars.discourse-cdn.com/v4/letter/j/eb8c5e/32.png) [@JensHaglof](https://discuss.elastic.co/u/JensHaglof)\
**Post date:** [March 28, 2025, 1:32pm UTC](https://discuss.elastic.co/t/cant-use-timestamp-in-where-clause/376517/5 "2025-03-28T13:32:45Z")

</div>

Oh I solved it. Of course, you had to escape the double quotes. \ "@timestamp \ "