Hi team, I need a query that takes the @timestamp from the timepicker and then add an offset of 7 days. I don't know how to do it. I tried: (@timestamp <= "now-1d/d+7d") but it's not working as I wanted. Could someone help me, please? Thanks!

I did some tests and the behavior is a bit weird. I have the same result by doing this : @timestamp >= "now-1d/d+11h" AND @timestamp <= "now-1d/d+13h" OR this : @timestamp <= "now-1d/d+13h" I tried everything but I can't go back any further than today's date at midnight ! Here another link tha…

Discuss the Elastic Stack

KQL from @timestamp until 7days offset

Elastic Stack Kibana

Juliana_Sabino (Juliana Sabino) January 19, 2022, 2:18pm 3

Thanks @baddack !

I'm just wondering what this guy did here -> Lucene syntax equivalent for "Today"? Does it exist? - #4 by wylie

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.