# How to get Today's log in kibana dev Tools

**URL:** https://discuss.elastic.co/t/how-to-get-todays-log-in-kibana-dev-tools/195218
**Category:** Kibana
**Created:** [August 14, 2019, 2:16pm UTC](https://discuss.elastic.co/t/how-to-get-todays-log-in-kibana-dev-tools/195218 "2019-08-14T14:16:31Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Fosiul\_Alam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fosiul_alam/32/43335_2.png) [@Fosiul\_Alam](https://discuss.elastic.co/u/Fosiul_Alam)
#### Post date: [August 14, 2019, 2:16pm UTC](https://discuss.elastic.co/t/how-to-get-todays-log-in-kibana-dev-tools/195218/1 "2019-08-14T14:16:32Z")

</div>

I am using Kibana dev tools to return all lines by using bellow Query in DEV tools, but instead of giving all matches, its gives only dates from when in installed this kibana.

```auto
GET filebeat-*/_search
{
  "query": {
    "match_all": {

    }
  }
}

```

but its only giving limited lines with date from when i installed elastic search i.e from 2019-07-29T04:57:04.118Z , but not recent.

```auto
{
  "took" : 1,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 10000,
      "relation" : "gte"
    },
    "max_score" : 1.0,
    "hits" : [
      {
        "_index" : "filebeat-7.2.0-2019.07.27-000001",
        "_type" : "_doc",
        "_id" : "XOQWPGwBUSUoRIJv1eua",
        "_score" : 1.0,
        "_source" : {
          "@timestamp" : "2019-07-29T04:57:04.118Z",
          "log" : {
            "offset" : 1404504,
            "file" : {
              "path" : "/root/root/standalone/log/test.log"
            }
          },
          "input" : {
            "type" : "log"
          },

          "message" : "04:57:03,425 TRACE [com.abc.jca.sockets.test] (default-threads - 5) MessageProcessor - ABC"
        }
      },

 {
        "_index" : "filebeat-7.2.0-2019.07.27-000001",
        "_type" : "_doc",
        "_id" : "XeQWPGwBUSUoRIJv1eua",
        "_score" : 1.0,
        "_source" : {
          "@timestamp" : "2019-07-29T04:57:04.118Z",
          "log" : {
            "offset" : 1404669,
            "file" : {
              "path" : "/root/root/standalone/log/test.log"
            }
          },
          "message" : "04:57:03,425 TRACE [com.ab.jca.sockets.abc] (default-threads - 5) MessageProcessor - ",

      },

```

Do i need to pass any parameter to get all matches , specially if i want to get from todays log, how shall i pass it ?

Thanks

---

<div class="post-metadata">

### Author: ![rorixrebel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rorixrebel/32/41778_2.png) [@rorixrebel](https://discuss.elastic.co/u/rorixrebel)
#### Post date: [August 14, 2019, 2:32pm UTC](https://discuss.elastic.co/t/how-to-get-todays-log-in-kibana-dev-tools/195218/2 "2019-08-14T14:32:21Z")

</div>

if you just want to get everything in that index you can just do

```
GET filebeat-*/_search

```

by default it returns 20 results but you can adjust.  
if you want specific dates then you need to add them to your query with `range`, something like:

```
GET filebeat-*/_search
 {
  "query": {
    "range": {
      "@timestamp": {
        "gte": "now-1d",
        "lte": "1d"
      }
    }
  }
}
```

---

<div class="post-metadata">

### Author: ![Fosiul\_Alam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fosiul_alam/32/43335_2.png) [@Fosiul\_Alam](https://discuss.elastic.co/u/Fosiul_Alam)
#### Post date: [August 14, 2019, 2:40pm UTC](https://discuss.elastic.co/t/how-to-get-todays-log-in-kibana-dev-tools/195218/3 "2019-08-14T14:40:19Z")

</div>

Hi  
Thanks  
How do i change from 20 to All out put ? also that gte formate giving bellow errror

````auto
{
  "error": {
    "root_cause": [
      {
        "type": "parse_exception",
        "reason": "failed to parse date field [1d] with format [strict_date_optional_time||epoch_millis]: [Text '1d' could not be parsed, unparsed text found at index 1]"
      }
    ],
    "type": "search_phase_execution_exception",
    "reason": "all shards failed",
    "phase": "query",
    "grouped": true,
    "failed_shards": [
      {
        "shard": 0,
        "index": "filebeat-7.2.0-2019.07.27-000001",
        "node": "U1V34js7Q7KN2HG4Cus8qA",
        "reason": {
          "type": "parse_exception",
          "reason": "failed to parse date field [1d] with format [strict_date_optional_time||epoch_millis]: [Text '1d' could not be parsed, unparsed text found at index 1]",
          "caused_by": {
            "type": "date_time_parse_exception",
            "reason": "Text '1d' could not be parsed, unparsed text found at index 1"
          }
        }
      }
    ]
  },
  "status": 400
}```
````

---

<div class="post-metadata">

### Author: ![rorixrebel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rorixrebel/32/41778_2.png) [@rorixrebel](https://discuss.elastic.co/u/rorixrebel)
#### Post date: [August 14, 2019, 2:54pm UTC](https://discuss.elastic.co/t/how-to-get-todays-log-in-kibana-dev-tools/195218/4 "2019-08-14T14:54:51Z")

</div>

add the parameter `size: #` at the top of your query to define a size.

```
    GET filebeat-*/_search
     { 
         "size": 1000,
          "query": { ....
        }
     }

```

Be mindful that giving it a huge number might be a problem - some might suggest using the scroll api - [https://www.elastic.co/guide/en/elasticsearch/reference/6.4/search-request-scroll.html](https://www.elastic.co/guide/en/elasticsearch/reference/6.4/search-request-scroll.html)

i may have messed up the format - you can find the right format in here  
[https://www.elastic.co/guide/en/elasticsearch/reference/6.4/common-options.html#date-math](https://www.elastic.co/guide/en/elasticsearch/reference/6.4/common-options.html#date-math)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 11, 2019, 2:55pm UTC](https://discuss.elastic.co/t/how-to-get-todays-log-in-kibana-dev-tools/195218/5 "2019-09-11T14:55:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
