Lucene syntax equivalent for "Today"? Does it exist?

Elastic Stack Kibana
1

I'm working on a visualization and have all the work done, I'm just having troubles making it automatically return only data from a specific time window.

So if I search Kibana for:
timestamp:" 04:*"
I get every log entry that happened between 4-5AM, any day. If I click the time option (top right of kibana) and select "Today", I get only entries from today between 4am to 5am. This is what I want to automate.

My main goal is to avoid forcing the user to manually select "Today" every time they try to use this visualization.

Pulling my hair out. Any assistance appreciated!

2

@cheiligers Thanks :slight_smile:

1 Like
3

@Jody_McIvor Thank you for your question.

Depending on the visualization you are creating, you might be able to use a date histogram aggregation. Otherwise you could look into creating a scripted field.

4

I know this was not the question, but you can definitely do this with KQL, for example:

@timestamp >= "now-1d/d+11h" AND @timestamp <= "now-1d/d+13h" searches for all @timestamps between in a 2-hour range based on midnight UTC+11h

I don't see a way to do this using Lucene syntax only.

1 Like
5

Thank you both for your responses, I'll see what I can figure out today, using your suggestions. I'll report back with any successes :slight_smile: (And thanks @bhavyarm for bringing this to @cheiligers's attention!)

6

Doctoring things a bit, I would hope this would work while bypassing the need to calculate time zone difference:
timestamp:" 04:*" AND timestamp>="now-1d/d+*h"
Alas, I seem to be wrong as it comes up empty. I wonder, could it be because I'm forcing it to query "timestamp" string as opposed to the system created "@timestamp" value? In either case I come up empty (As well as with your original snippet, but I chalked that up to me thinking it was a time zone thing).

7

I'm not sure the datemath supports any kind of wildcard- now-1d/d+4h would work but I don't think the one you just posted will. Unfortunately datemath has no documentation that I can find, but our JS implementation only supports + - and / as operations, where / is a "beginning of interval" operation

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.