# KQL from @timestamp until 7days offset

**URL:** <https://discuss.elastic.co/t/kql-from-timestamp-until-7days-offset/294819>\
**Category:** Kibana\
**Tags:** kql-kibana-query-language\
**Created:** [January 19, 2022, 1:37pm UTC](https://discuss.elastic.co/t/kql-from-timestamp-until-7days-offset/294819 "2022-01-19T13:37:49Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Juliana\_Sabino](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juliana_sabino/32/100475_2.png) [@Juliana\_Sabino](https://discuss.elastic.co/u/Juliana_Sabino)\
**Post date:** [January 19, 2022, 1:37pm UTC](https://discuss.elastic.co/t/kql-from-timestamp-until-7days-offset/294819/1 "2022-01-19T13:37:49Z")

</div>

Hi team,

I need a query that takes the @timestamp from the timepicker and then add an offset of 7 days. I don't know how to do it. I tried: `(@timestamp <= "now-1d/d+7d")` but it's not working as I wanted.

Could someone help me, please?

Thanks!

---

<div class="post-metadata">

**Author:** ![baddack](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/baddack/32/100535_2.png) [@baddack](https://discuss.elastic.co/u/baddack)\
**Post date:** [January 19, 2022, 1:49pm UTC](https://discuss.elastic.co/t/kql-from-timestamp-until-7days-offset/294819/2 "2022-01-19T13:49:50Z")

</div>

Hello,

According to this topic it's not possible to add an offset to timestamp  
==\> [Kibana Query Language - @timestamp](https://discuss.elastic.co/t/kibana-query-language-timestamp/229403)

They talked about some alternatives that may help you... sorry if not 😥

Sincerely,

---

<div class="post-metadata">

**Author:** ![Juliana\_Sabino](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juliana_sabino/32/100475_2.png) [@Juliana\_Sabino](https://discuss.elastic.co/u/Juliana_Sabino)\
**Post date:** [January 19, 2022, 2:18pm UTC](https://discuss.elastic.co/t/kql-from-timestamp-until-7days-offset/294819/3 "2022-01-19T14:18:34Z")

</div>

Thanks @baddack !

I'm just wondering what this guy did here -\> [Lucene syntax equivalent for "Today"? Does it exist? - #4 by wylie](https://discuss.elastic.co/t/lucene-syntax-equivalent-for-today-does-it-exist/204699/4)

---

<div class="post-metadata">

**Author:** ![baddack](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/baddack/32/100535_2.png) [@baddack](https://discuss.elastic.co/u/baddack)\
**Post date:** [January 19, 2022, 3:22pm UTC](https://discuss.elastic.co/t/kql-from-timestamp-until-7days-offset/294819/4 "2022-01-19T15:22:59Z")

</div>

I did some tests and the behavior is a bit weird.

I have the same result by doing this :

`@timestamp >= "now-1d/d+11h" AND @timestamp <= "now-1d/d+13h"`

**OR** this :

`@timestamp <= "now-1d/d+13h"`

I tried everything but I can't go back any further than today's date at midnight !

Here another link that I found very helpful to understand :

**[Several date math questions](https://discuss.elastic.co/t/several-date-math-questions/27453/3)**

I found it very easy to understand but in practice I couldn't get it to work beyond today's intervals

---

<div class="post-metadata">

**Author:** ![Juliana\_Sabino](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juliana_sabino/32/100475_2.png) [@Juliana\_Sabino](https://discuss.elastic.co/u/Juliana_Sabino)\
**Post date:** [January 19, 2022, 9:55pm UTC](https://discuss.elastic.co/t/kql-from-timestamp-until-7days-offset/294819/5 "2022-01-19T21:55:35Z")

</div>

Thank you so so much! I was able to do what I wanted using that last link.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 16, 2022, 9:56pm UTC](https://discuss.elastic.co/t/kql-from-timestamp-until-7days-offset/294819/6 "2022-02-16T21:56:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.