# Elasticsearch SQL - HAVING query seems to have broken

**URL:** <https://discuss.elastic.co/t/elasticsearch-sql-having-query-seems-to-have-broken/235312>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-sql\
**Created:** [June 2, 2020, 10:20am UTC](https://discuss.elastic.co/t/elasticsearch-sql-having-query-seems-to-have-broken/235312 "2020-06-02T10:20:13Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![flxdan](https://avatars.discourse-cdn.com/v4/letter/f/cc9497/32.png) [@flxdan](https://discuss.elastic.co/u/flxdan)\
**Post date:** [June 2, 2020, 10:20am UTC](https://discuss.elastic.co/t/elasticsearch-sql-having-query-seems-to-have-broken/235312/1 "2020-06-02T10:20:13Z")

</div>

For reporting purposes I created a SQL query to report when a winlogbeat agent hasn't sent any data within the last hour:

```auto
    POST _sql?format=txt
    {
      "query": """
      select agent.hostname, max("@timestamp") from "winlogbeat-*" group by agent.hostname HAVING (max("@timestamp") < NOW() - INTERVAL 1 HOUR)
      """
    }

```

This was definitely working in Elasticsearch 7.6.2, but it **looks like since we upgraded to 7.7.0** (in Elastic Cloud) this doesn't seem to return any results any more - nor are any errors logged that I can find.

Pretty sure I should get some results from this query, as if I run the following:

```auto
    POST _sql?format=txt
    {
      "query": """
      select agent.hostname, max("@timestamp") from "winlogbeat-*" group by agent.hostname order by max("@timestamp")
      """
    }

```

I get results like:

```auto
    agent.hostname | max("@timestamp")    
    ---------------+------------------------
    DESKTOP-x1|2020-03-19T17:30:14.112Z
    DESKTOP-x2|2020-04-25T09:19:22.479Z
    DESKTOP-x3|2020-05-11T23:11:00.538Z
    DESKTOP-x4|2020-05-14T16:03:10.669Z

```

Any ideas what could be happening here?

---

<div class="post-metadata">

**Author:** ![Andrei\_Stefan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrei_stefan/32/47533_2.png) [@Andrei\_Stefan](https://discuss.elastic.co/u/Andrei_Stefan)\
**Post date:** [June 3, 2020, 6:11am UTC](https://discuss.elastic.co/t/elasticsearch-sql-having-query-seems-to-have-broken/235312/2 "2020-06-03T06:11:12Z")

</div>

@flxdan thank you for raising this concern.  
This is a bug. I've created [this issue](https://github.com/elastic/elasticsearch/issues/57581) to track it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 1, 2020, 6:11am UTC](https://discuss.elastic.co/t/elasticsearch-sql-having-query-seems-to-have-broken/235312/3 "2020-07-01T06:11:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.