Kibana Filter for a specific time range

Hi,

You can actually not really filter on a date field like you wish.

If you want to filter for the specific hour of the day, you would need to extract that into it's own field.
You can either do this via a scripted field, in the index pattern settings or (which would be more performant) before indexing the documents (aka in any kind of pre-processing step), but that would mean, you need to add some pre-processing before inserting the data from beats into Elasticsearch.

If you add a scripted field, you can use the following painless script (and set the field type to number):

doc['@timestamp'].date.hourOfDay + 2

Since Elasticsearch stores dates internally as pure UTC timestamps, you need to manually add/subtract your timezone to it, since ES doesn't have a knowledge about that anymore. In that case we are assuming UTC+2.

You can now easily create a filter in Discover for that field, and say, it must be within two values, or have a specific value, etc:

screenshot-20171025-151421

Cheers,
Tim

3 Likes