# Date Maths in Kibana Query Language

**URL:** <https://discuss.elastic.co/t/date-maths-in-kibana-query-language/344556>\
**Category:** Kibana\
**Tags:** kql-kibana-query-language\
**Created:** [October 7, 2023, 12:07am UTC](https://discuss.elastic.co/t/date-maths-in-kibana-query-language/344556 "2023-10-07T00:07:03Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Marcos\_Ivan\_Robles\_H](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcos_ivan_robles_h/32/121557_2.png) [@Marcos\_Ivan\_Robles\_H](https://discuss.elastic.co/u/Marcos_Ivan_Robles_H)\
**Post date:** [October 7, 2023, 12:07am UTC](https://discuss.elastic.co/t/date-maths-in-kibana-query-language/344556/1 "2023-10-07T00:07:03Z")

</div>

I am trying to use [date math](https://www.elastic.co/guide/en/elasticsearch/reference/8.10/common-options.html#date-math) in my query without success.

When I paste a KQL query on the web explorer's address bar I got a successful result with an example like this:

- base url + **time:(from:'2023-10-06T20:44:13.558Z',to:'2023-10-06T20:44:13.558Z'))** + more parameters

but I want to subtract 1 Hour in the **from** parameter so I tried KQL queries like the following without success:

- base url + **time:(from:'2023-10-06T20:44:13.558\|\|-1H',to:'2023-10-06T20:44:13.558Z'))** + more parameters

- base url + **time:(from:'2023-10-06T20:44:13.558||-1H',to:'2023-10-06T20:44:13.558Z'))** + more parameters

- base url + **time:(from:'2023-10-06T20:44:13.558Z%5C%7C%5C%7C-1H',to:'2023-10-06T20:44:13.558Z'))** + more parameters

I also tried a DSL Query like this succesfully:

```auto
"query": {
    "bool": {
      "must": [],
      "filter": [
        {
          "bool": {
            "should": [
              {
                "term": {
                  "level.keyword": "Error"
                }
              }
            ],
            "minimum_should_match": 1
          }
        },
        {
          "range": {
            "@timestamp": {
              "format": "strict_date_optional_time",
              "gte": "2023-10-06T20:44:13.558Z||-1H",
              "lte": "2023-10-06T20:44:13.558Z"
            }
          }
        }
      ],
      "should": [],
      "must_not": []
    }
  },

```

but I need the KQL not the DSL query.

**Note:** The goal for all this is to be able to send a email via the body of elastic alerts/rules which points to the specific errors the rule found .

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [October 7, 2023, 1:56am UTC](https://discuss.elastic.co/t/date-maths-in-kibana-query-language/344556/2 "2023-10-07T01:56:23Z")

</div>

I think the perhaps proper syntax is

`'2023-10-06T20:44:13.558||+1h/h'`

I am not sure you can do what you want I would need to test.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [October 7, 2023, 2:25am UTC](https://discuss.elastic.co/t/date-maths-in-kibana-query-language/344556/3 "2023-10-07T02:25:40Z")

</div>

The Correct KQL is this  
`@timestamp > "2023-10-06T01:12:35.144Z||-1h/h"`

And from what I see you can not use that syntax in the from to... you will need to add it to the extra kql portion of the URL

```auto
https://localhost:9200/app/discover#/?_g=(filters:!(),refreshInterval:(pause:!t,value:60000),time:(from:now-24h%2Fh,to:now))&_a=(columns:!(),filters:!(),index:'logs-*',interval:auto,query:(language:kuery,query:'@timestamp%20%3E%20%222023-10-06T01:12:35.144Z%7C%7C-1h%2Fh%22'),sort:!(!('@timestamp',desc)))

```

Its this part believe

```auto
query:(language:kuery,query:'@timestamp%20%3E%20%222023-10-06T01:12:35.144Z%7C%7C-1h%2Fh%22')

```

That is the encoded version of the KQL at the top, pretty sure if you need to encoded

I tried without encoded it seemed to work too.

```auto
https://localhost:9200/app/discover#/?_g=(filters:!(),refreshInterval:(pause:!t,value:60000),time:(from:now-24h%2Fh,to:now))&_a=(columns:!(),filters:!(),index:'logs-*',interval:auto,query:(language:kuery,query:'@timestamp > "2023-10-06T01:12:35.144Z||-1h/h"'),sort:!(!('@timestamp',desc)))

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 4, 2023, 2:26am UTC](https://discuss.elastic.co/t/date-maths-in-kibana-query-language/344556/4 "2023-11-04T02:26:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.