Elastic SQL is not working with time bound data

Elastic Stack Elasticsearch
#1

this search is working without time field how i can make it work with time bound.

POST _sql?format=txt
{
"query":"SELECT network,usage.total from clients where usage.total <= 1000 AND '@timestamp' < now() - INTERVAL 7 MINUTE order by usage.total DESC"
}

#2

@farrukh_aziz I'm sorry, but I don't understand the question. Can you provide more details or ask the question differently?

Also, your query is slightly wrong. It should be SELECT network,usage.total from clients where usage.total <= 1000 AND \"@timestamp\" < now() - INTERVAL 7 MINUTE order by usage.total DESC. @timestamp should be surrounded by double quotes (not simple ones) and they should be escaped.

#3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.