Gather Data from Yesterday Until Today

[hi_xavier (Xavier)]

Hello,

I'm currently using the elk api to gather data between yesterday and today (12/19 @ 00:00:000 -- 12/20@00:00:000)
Would this be the equivalent of that using a range query?

"range": {
    "timestamp": {
        "gte": "now-1d/d",
        "lte": "now/d",
                   }
}

[stephenb (Stephen Brown)]

Hi @hi_xavier

Yes in general that is correct

You can try a quick search to validate...

Of course for Today... the last timestamp will be only up to the current time...

GET logs-*/_search
{
  "size": 0, 
  "query": {
    "range": {
      "@timestamp": {
        "gte": "now/d-1d/d",
        "lte": "now/d"
      }
    }
  },
  "aggs": {
    "max": {
      "max": {
        "field": "@timestamp"
      }
    },
    "min": {
      "min": {
        "field": "@timestamp"
      }
    }  
  }
}

[hi_xavier (Xavier)]

Understood! Thanks @stephenb !