# How do I query last 1 hour of data and order it based on time?

**URL:** <https://discuss.elastic.co/t/how-do-i-query-last-1-hour-of-data-and-order-it-based-on-time/143069>\
**Category:** Elasticsearch\
**Created:** [August 5, 2018, 5:50pm UTC](https://discuss.elastic.co/t/how-do-i-query-last-1-hour-of-data-and-order-it-based-on-time/143069 "2018-08-05T17:50:38Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![blueren](https://avatars.discourse-cdn.com/v4/letter/b/ecae2f/32.png) [@blueren](https://discuss.elastic.co/u/blueren)\
**Post date:** [August 5, 2018, 5:50pm UTC](https://discuss.elastic.co/t/how-do-i-query-last-1-hour-of-data-and-order-it-based-on-time/143069/1 "2018-08-05T17:50:39Z")

</div>

Hello,

I have data in ES such as:

```
@timestamp --> Timestamp field
record.hostIP 
record.destIP
record.port
record.application
etc...

```

I would like to plot this on a graph in js and hence need time on the X axis and count of record.\<\> on the Y axis.

This query gets me docs sorted by timestamp vs count (of all documents).  
What do I want to do if I need count of record.application in the last 1 hour, sorted by timestamp from earliest to latest?

```
GET _search
{
        "size": "0",
        "aggs": {
            "oneHourTimeRange": {
                "filter": {
                    "range": {
                        "@timestamp": {
                            "gte": "now-60m",
                            "lte": "now"
                        }
                    }
                },
                "aggs": {
                    "totalTraffic": {
                    "terms": {
                        "field": "@timestamp",
                        "size": 500,
                        "order": { "_key": "asc" } 
                    }
                }
            }
        }  
    }
}
```

---

<div class="post-metadata">

**Author:** ![blueren](https://avatars.discourse-cdn.com/v4/letter/b/ecae2f/32.png) [@blueren](https://discuss.elastic.co/u/blueren)\
**Post date:** [August 6, 2018, 5:02pm UTC](https://discuss.elastic.co/t/how-do-i-query-last-1-hour-of-data-and-order-it-based-on-time/143069/2 "2018-08-06T17:02:36Z")

</div>

I would really appreciate done some helpful tips over this!

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 3, 2018, 5:02pm UTC](https://discuss.elastic.co/t/how-do-i-query-last-1-hour-of-data-and-order-it-based-on-time/143069/3 "2018-09-03T17:02:38Z")

</div>

Closed on September 3, 2018, 5:02pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.