Hi team, I need a query that takes the @timestamp from the timepicker and then add an offset of 7 days. I don't know how to do it. I tried: (@timestamp <= "now-1d/d+7d") but it's not working as I wanted. Could someone help me, please? Thanks!

I did some tests and the behavior is a bit weird. I have the same result by doing this : @timestamp >= "now-1d/d+11h" AND @timestamp <= "now-1d/d+13h" OR this : @timestamp <= "now-1d/d+13h" I tried everything but I can't go back any further than today's date at midnight ! Here another link tha…

Discuss the Elastic Stack

KQL from @timestamp until 7days offset

Elastic Stack Kibana

Juliana_Sabino (Juliana Sabino) January 19, 2022, 2:18pm 3

Thanks @baddack !

I'm just wondering what this guy did here -> Lucene syntax equivalent for "Today"? Does it exist? - #4 by wylie

Topic		Replies	Views
Kibana Query Language - @timestamp Kibana	6	3644	May 21, 2020
Lucene syntax equivalent for "Today"? Does it exist? Kibana	7	5139	November 20, 2019
Date Maths in Kibana Query Language Kibana kql-kibana-query-language	3	1200	November 4, 2023
What's the Lucene equivalent of KQL query: now/d Kibana	4	295	November 9, 2022
Date math in Kibana 5 Kibana	9	3581	December 22, 2016

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

KQL from @timestamp until 7days offset

Related topics