How to get the data from yesterday to today's date range

Elastic Stack Elasticsearch
1 
Hello Experts,

I have tried to get the data between dates as below, but the exact date it is not giving.It is under UTC format.
"range" : {
                "@timestamp" : {
                  "gte": "now-1d/d ",
                  "lt": "now/d"
                }
              }
            
Please help how to get the data for last 24 hours between dates.

Regards,
Suresh
2

Please just format the code part with the markdown code characters, not the whole text. Thanks.

Could you explain a bit more what you are looking for? I don't understand what the problem is with the current query.

3 
Hi Dadoonet,

We have dev-applogs index in which we would like to get container_name and message field by filtering message : "exception".

**What we are expecting** 

It should come the data between yesterday midnight to now(specific time)
Example : 25-03-2021 midnight to 26-03-201 

But now I am not able to fetch the data between dates and time.

`curl -X GET "http://elasticsearchip:port/dev-applogs-*/_search?pretty" -H `'Content-Type: application/json' -d'
`{
  `  "_source": [ "kubernetes.container.name", "kubernetes.namespace", `"message", "@timestamp" ],
  `  "query": {
    `    "bool": {
      `    "must": [
        `    {
          `    "match": {"message": "exception"}
            `},
            `{
              `"range" : {
                `"@timestamp" : {
                  `"gte": "now-1d/d",
                  `"lt": "now/d"
                `}
              `}
            `}
           `]
          `}
         `}
`}
`'

What I need to give exactly to get the whole data from Yesterday to now.
"gte": "now-1d/d",
"lt": "now/d"

Regards,
Suresh
4

PLEASE.

Please just format the code part with the markdown code characters, not the whole text. Thanks.

Could you edit your post please and make it more readable? Thanks!

5

Can you please look into above.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.