How to get two different timefilters for two date-fields

[basti1798]

Hi all,

for my project I have to use all data in kibana, which has a timestamp of the last week, which is not the problem.
But there is another date field called lastSeen which is independent to the timestamp and this date have to be in the last month.

So have anyone an idea how I can filter data in that way that one date field is not older than a week and the other one is not older than a month?

Thanks in advance.

[Aaron_Caldwell]

Hello,

You could use the Kibana Time Filter to narrow results by the index pattern's default date field and then enter a KQL query in the query bar to filter by the other attribute.

Alternatively you could just by pass the Time Filter altogether and enter both criteria in the query bar. From what you're describing, you'd just apply them both using an and between the two filter queries.

Hope that helps!

Regards,
Aaron

[basti1798]

Thanks for the fast answer.

That is a possible way to solve the Problem but in KQL I can use specific dates like "2021-07-27...". Because I need the date monthly it would be better if I could say "not older than a week" or "older than a month" or something like this.

Is there also a way to express this in KQL?

Again thanks in advance for your help.