# Need help with query for heartbeat

**URL:** <https://discuss.elastic.co/t/need-help-with-query-for-heartbeat/115904>\
**Category:** Elasticsearch\
**Created:** [January 17, 2018, 3:01pm UTC](https://discuss.elastic.co/t/need-help-with-query-for-heartbeat/115904 "2018-01-17T15:01:39Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bozzerreaneaux](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bozzerreaneaux/32/21613_2.png) [@Bozzerreaneaux](https://discuss.elastic.co/u/Bozzerreaneaux)\
**Post date:** [January 17, 2018, 3:01pm UTC](https://discuss.elastic.co/t/need-help-with-query-for-heartbeat/115904/1 "2018-01-17T15:01:40Z")

</div>

Hello,

I have the following query with matches all results with heartbeat field "up"=false.

```
GET heartbeat-2018.01.17/_search
{
  "query": {
    "match": {
      "up": {
        "query": false
      }
    }
  }
}

```

Can you help me filter the results to show only matches not older than say 15 minutes from now.  
I can't seem to combine the match with range filter

Here's an example structure of the beat:

```
{
    "_index": "heartbeat-2018.01.17",
    "_type": "doc",
    "_id": "AWEDb-F0ffEhnz27e7Lf",
    "_score": 3.648773,
    "_source": {
      "@timestamp": "2018-01-17T09:25:17.936Z",
      "beat": {
        "hostname": "#######",
        "name": "#######",
        "version": "5.6.0"
      },
      "duration": {
        "us": 997911
      },
      "error": {
        "message": "Get http://#####: dial tcp#####: connectex: No connection could be made because the target machine actively refused it.",
        "type": "io"
      },
      "host": "#####",
      "ip": "#####",
      "monitor": "#####",
      "port": 3000,
      "resolve_rtt": {
        "us": 986
      },
      "scheme": "http",
      "tcp_connect_rtt": {
        "us": 996924
      },
      "type": "http",
      "up": false,
      "url": "#####"
    }
  }
```

---

<div class="post-metadata">

**Author:** ![val](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/val/32/138203_2.png) [@val](https://discuss.elastic.co/u/val)\
**Post date:** [January 17, 2018, 3:18pm UTC](https://discuss.elastic.co/t/need-help-with-query-for-heartbeat/115904/2 "2018-01-17T15:18:42Z")

</div>

Just modify your query like this to include a `range` query on the `@timestamp` field:

```
GET heartbeat-2018.01.17/_search
{
  "query": {
    "bool": {
      "filter": [
        {
          "match": {
            "up": {
              "query": false
            }
          }
        },
        {
          "range": {
            "@timestamp": {
              "gte": "now-15m"
            }
          }
        }
      ]
    }
  }
}
```

---

<div class="post-metadata">

**Author:** ![Bozzerreaneaux](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bozzerreaneaux/32/21613_2.png) [@Bozzerreaneaux](https://discuss.elastic.co/u/Bozzerreaneaux)\
**Post date:** [January 17, 2018, 3:28pm UTC](https://discuss.elastic.co/t/need-help-with-query-for-heartbeat/115904/3 "2018-01-17T15:28:51Z")

</div>

@val, you are legend!

I' ve been struggling with this for a whole day.

Thank you so much!

---

<div class="post-metadata">

**Author:** ![val](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/val/32/138203_2.png) [@val](https://discuss.elastic.co/u/val)\
**Post date:** [January 17, 2018, 3:30pm UTC](https://discuss.elastic.co/t/need-help-with-query-for-heartbeat/115904/4 "2018-01-17T15:30:36Z")

</div>

Glad it helped 😉

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 14, 2018, 3:30pm UTC](https://discuss.elastic.co/t/need-help-with-query-for-heartbeat/115904/5 "2018-02-14T15:30:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.