# Lucene syntax equivalent for "Today"? Does it exist?
**URL:** https://discuss.elastic.co/t/lucene-syntax-equivalent-for-today-does-it-exist/204699
**Category:** Kibana
**Created:** [October 22, 2019, 5:30pm UTC](https://discuss.elastic.co/t/lucene-syntax-equivalent-for-today-does-it-exist/204699 "2019-10-22T17:30:30Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@Jody\_McIvor](https://discuss.elastic.co/u/Jody_McIvor)
#### Post date: [October 22, 2019, 5:30pm UTC](https://discuss.elastic.co/t/lucene-syntax-equivalent-for-today-does-it-exist/204699/1 "2019-10-22T17:30:30Z")
I'm working on a visualization and have all the work done, I'm just having troubles making it automatically return only data from a specific time window.
So if I search Kibana for:
`timestamp:" 04:*"`
I get every log entry that happened between 4-5AM, any day. If I click the time option (top right of kibana) and select "Today", I get only entries from today between 4am to 5am. This is what I want to automate.
My main goal is to avoid forcing the user to manually select "Today" every time they try to use this visualization.
Pulling my hair out. Any assistance appreciated!
---
### Author:  [@bhavyarm](https://discuss.elastic.co/u/bhavyarm)
#### Post date: [October 22, 2019, 8:58pm UTC](https://discuss.elastic.co/t/lucene-syntax-equivalent-for-today-does-it-exist/204699/2 "2019-10-22T20:58:47Z")
@cheiligers Thanks 🙂
---
### Author:  [@cheiligers](https://discuss.elastic.co/u/cheiligers)
#### Post date: [October 22, 2019, 11:55pm UTC](https://discuss.elastic.co/t/lucene-syntax-equivalent-for-today-does-it-exist/204699/3 "2019-10-22T23:55:03Z")
@Jody_McIvor Thank you for your question.
Depending on the visualization you are creating, you might be able to use a [date histogram aggregation](https://www.elastic.co/guide/en/elasticsearch/reference/master/search-aggregations-bucket-datehistogram-aggregation.html). Otherwise you could look into creating a [scripted field](https://www.elastic.co/guide/en/elasticsearch/reference/master/search-request-body.html#request-body-search-script-fields).
---
### Author:  [@wylie](https://discuss.elastic.co/u/wylie)
#### Post date: [October 23, 2019, 1:17am UTC](https://discuss.elastic.co/t/lucene-syntax-equivalent-for-today-does-it-exist/204699/4 "2019-10-23T01:17:02Z")
I know this was not the question, but you can definitely do this with KQL, for example:
`@timestamp >= "now-1d/d+11h" AND @timestamp <= "now-1d/d+13h"` searches for all @timestamps between in a 2-hour range based on midnight UTC+11h
I don't see a way to do this using Lucene syntax only.
---
### Author:  [@Jody\_McIvor](https://discuss.elastic.co/u/Jody_McIvor)
#### Post date: [October 23, 2019, 2:34pm UTC](https://discuss.elastic.co/t/lucene-syntax-equivalent-for-today-does-it-exist/204699/5 "2019-10-23T14:34:50Z")
Thank you both for your responses, I'll see what I can figure out today, using your suggestions. I'll report back with any successes 🙂 (And thanks @bhavyarm for bringing this to @cheiligers's attention!)
---
### Author:  [@Jody\_McIvor](https://discuss.elastic.co/u/Jody_McIvor)
#### Post date: [October 23, 2019, 3:27pm UTC](https://discuss.elastic.co/t/lucene-syntax-equivalent-for-today-does-it-exist/204699/6 "2019-10-23T15:27:00Z")
Doctoring things a bit, I would hope this would work while bypassing the need to calculate time zone difference:
`timestamp:" 04:*" AND timestamp>="now-1d/d+*h"`
Alas, I seem to be wrong as it comes up empty. I wonder, could it be because I'm forcing it to query "timestamp" string as opposed to the system created "@timestamp" value? In either case I come up empty (As well as with your original snippet, but I chalked that up to me thinking it was a time zone thing).
---
### Author:  [@wylie](https://discuss.elastic.co/u/wylie)
#### Post date: [October 23, 2019, 5:27pm UTC](https://discuss.elastic.co/t/lucene-syntax-equivalent-for-today-does-it-exist/204699/7 "2019-10-23T17:27:26Z")
I'm not sure the datemath supports any kind of wildcard- `now-1d/d+4h` would work but I don't think the one you just posted will. Unfortunately datemath has no documentation that I can find, but our JS implementation only supports `+` `-` and `/` as operations, where `/` is a "beginning of interval" operation
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 20, 2019, 5:37pm UTC](https://discuss.elastic.co/t/lucene-syntax-equivalent-for-today-does-it-exist/204699/8 "2019-11-20T17:37:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.