# Different number of hits between DSL Query and KQL

**URL:** <https://discuss.elastic.co/t/different-number-of-hits-between-dsl-query-and-kql/277063>\
**Category:** Elasticsearch\
**Created:** [June 25, 2021, 1:30pm UTC](https://discuss.elastic.co/t/different-number-of-hits-between-dsl-query-and-kql/277063 "2021-06-25T13:30:49Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![baddack](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/baddack/32/100535_2.png) [@baddack](https://discuss.elastic.co/u/baddack)\
**Post date:** [June 25, 2021, 1:30pm UTC](https://discuss.elastic.co/t/different-number-of-hits-between-dsl-query-and-kql/277063/1 "2021-06-25T13:30:49Z")

</div>

Hello everyone,

I was curious about working with `DSL` queries, so I made some tests and I found something strange.

I have a `winlogbeat-security` index which contains windows security events and I am searching logs with the following term `"Échec de l’audit"` in a specific range.

However, when I am using `DSL` query I didn't have the same result as the `KQL`.

Look at the first picture :

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/0/3010eaa65c37d502b9d6ac5f4aea07c78917f15f.png)

Here I am using `KQL` with Kibana interface and I got 1553 hits.

On the second picture we can see the same query but I have only 119 hits.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/3/033b097d1f1acd63bcd08973a8ecd094c126f4b9.png)

If you have any ideas I will be happy to read you 🙂

Thank you !

---

<div class="post-metadata">

**Author:** ![baddack](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/baddack/32/100535_2.png) [@baddack](https://discuss.elastic.co/u/baddack)\
**Post date:** [June 28, 2021, 11:11am UTC](https://discuss.elastic.co/t/different-number-of-hits-between-dsl-query-and-kql/277063/2 "2021-06-28T11:11:50Z")

</div>

Hello everyone,

I fixed this problem by adding the time zone parameter like this :

```auto
GET winlogbeat-security/_search
{
  "query": {
    "bool": {
      "filter": [
        {"term": {"winlog.keywords": "Échec de l’audit"}},
        {"range": {"@timestamp": {"time_zone": "+02:00","gte": "2021-06-25T11:29:00.000", "lte": "2021-06-25T11:30:00.000"}}}
      ]
    }
  }
}

```

Now I have every hits about my query :

```auto
{
  "took" : 11,
  "timed_out" : false,
  "_shards" : {
    "total" : 53,
    "successful" : 53,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" :1553,
      "relation" : "eq"
    },

```

Thanks for reading 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 26, 2021, 11:12am UTC](https://discuss.elastic.co/t/different-number-of-hits-between-dsl-query-and-kql/277063/3 "2021-07-26T11:12:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.