In Lucene for a date range its possible to do date:{* TO 2012-01-01}, is it possible to use the now date time such as
date:{now-60d/d TO now/d}
This should work. See the discussion here for more information, but it looks like this is supported in Lucene and KQL.
Thanks for the response @devon.thomson and the link, I read the article linked and tried it out and it does work fine in KQL but i have not been able to get it to work in Lucene. Any other format than
date.field >= "now-1d/d+11h"
and it errors and that format above does not return any results. I am running Elastic/Kibana 7.9 which could be unsupported?
Im having to use Lucene as im trying to get Filter Ratio to work which i asked a question on also.
Cheers anyway.
Follow up
Lucene doesn't support it so re-configured the field to just hold the date its invalid date > now/d
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.