Customizing Time Filter Quick Ranges in Kibana: dynamicly adapat based on a specific time

[Behnam.R (Behnam Ramouzeh)]

I'm looking to customize Kibana's Time Filter Quick Ranges with a specific date math expression and need advice on feasibility and syntax. The expression I want to use is:

{
  "from": "((now-6h)/d)+6h",
  "to": "now",
  "display": "current operation"
}

The goal is to start the range 6 hours ago, rounded to the start of the day, plus 6 hours, ending now:

now>=06:00 => 06:00 today to now
now<06:00 => 06:00 yesterday to now

I have tried this and kibana return no result for the chosen custom timefram. I'm unsure if this complexity is achievable in Kibana's date math.

Could anyone guide me on:

1. The possibility of implementing this expression.
2. The correct syntax, if feasible.
3. Alternatives for setting such a specific time range.

Thanks for any insights!

[Priscilla_Parodi]

Hello @Behnam.R,

Are you using Kibana Discover? What is the version?

@Behnam.R

The possibility of implementing this expression.

You can edit the filter as a query DSL and then use a range query with the timestamp field.

Range query | Elasticsearch Guide [8.11] | Elastic

[Priscilla_Parodi]

@Behnam.R

• The correct syntax, if feasible.
• Alternatives for setting such a specific time range.

Assuming that I understood correctly, and in this case, your query would be similar to this one:

Where "now-6h/d" gets the current time minus six hours, rounded to the start of the day +6h.

[Behnam.R (Behnam Ramouzeh)]

@Priscilla_Parodi , I am using the kibana 8.6.1. And I want to have this timerange option for all the dashboards. But thanks for the input, I was using then the wrong date math syntax, now I have added your timestamp field in the Advance setting in kibana and it works fine.

[Priscilla_Parodi]

Thanks for the context. You’re welcome!