KQL from @timestamp until 7days offset

Elastic Stack Kibana
1

Hi team,

I need a query that takes the @timestamp from the timepicker and then add an offset of 7 days. I don't know how to do it. I tried: (@timestamp <= "now-1d/d+7d") but it's not working as I wanted.

Could someone help me, please?

Thanks!

2

Hello,

According to this topic it's not possible to add an offset to timestamp
==> Kibana Query Language - @timestamp

They talked about some alternatives that may help you... sorry if not :disappointed_relieved:

Sincerely,

3

Thanks @baddack !

I'm just wondering what this guy did here -> Lucene syntax equivalent for "Today"? Does it exist? - #4 by wylie

4

I did some tests and the behavior is a bit weird.

I have the same result by doing this :

@timestamp >= "now-1d/d+11h" AND @timestamp <= "now-1d/d+13h"

OR this :

@timestamp <= "now-1d/d+13h"

I tried everything but I can't go back any further than today's date at midnight !

Here another link that I found very helpful to understand :

Several date math questions

I found it very easy to understand but in practice I couldn't get it to work beyond today's intervals

5

Thank you so so much! I was able to do what I wanted using that last link.

1 Like
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.