Elasticsearch Query setting date conditions

Elastic Stack Kibana
1

I am setting up Alerting Rules under Rules and Connections.

My query works great, but I need to not see the alerts during the maintenance window from 9 pm to 5 am.

Here is my query:

{
  "query" : {
    "bool" : {
      "must" : [
        {"match" : {"log.level" : "Error"}}
        ],
      "filter": [
        {"terms": {
          "agent.hostname": [
            "Server1p",
            "Server2p",
            "Server3p"
          ]
        }}
      ]        
    }
  }
}

How can I add a condition to only have the query work from 5 am to 9 pm?

2

Hello @DavidGreensfelder,

You can use a range query with the date field.

  "range": {
        "timestamp": {
          "time_zone": "+01:00", 
          "gte": "2023-06-28T05:00:00",
          "lte": "2023-06-28T21:00:00"
        }
      }

Make sure you are checking the time zone.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.