# Perform date math calculation inside elasticsearch filter plugin

**URL:** <https://discuss.elastic.co/t/perform-date-math-calculation-inside-elasticsearch-filter-plugin/123581>\
**Category:** Logstash\
**Created:** [March 12, 2018, 3:38pm UTC](https://discuss.elastic.co/t/perform-date-math-calculation-inside-elasticsearch-filter-plugin/123581 "2018-03-12T15:38:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mirkomirko](https://avatars.discourse-cdn.com/v4/letter/m/df705f/32.png) [@mirkomirko](https://discuss.elastic.co/u/mirkomirko)\
**Post date:** [March 12, 2018, 3:38pm UTC](https://discuss.elastic.co/t/perform-date-math-calculation-inside-elasticsearch-filter-plugin/123581/1 "2018-03-12T15:38:09Z")

</div>

Hi guys, I'm stucked in trying to perform some date math inside logstash. In particular, for a specific event, I've to query elastic and retrieve all documents that are in a range of 30 minutes from the time written inside a log file.  
I.E: date of the event is: 2018-10-02T03:50:000.000Z and I want to search documents that are in a range of +-30minutes.  
I try the following inside the filter plugin of elasticsearch, but with no success:  
`query => "access_time: [%{eventDate}||-30m TO %{eventDate}]"`  
and this one:  
`query => "access_time: [%{eventDate}-30m TO %{eventDate}]"`.  
Both does not work. Do you know what is the right syntax?

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![mirkomirko](https://avatars.discourse-cdn.com/v4/letter/m/df705f/32.png) [@mirkomirko](https://discuss.elastic.co/u/mirkomirko)\
**Post date:** [March 16, 2018, 4:10pm UTC](https://discuss.elastic.co/t/perform-date-math-calculation-inside-elasticsearch-filter-plugin/123581/2 "2018-03-16T16:10:49Z")

</div>

Solved by performing date math inside ruby plugin 😉 .

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 13, 2018, 4:10pm UTC](https://discuss.elastic.co/t/perform-date-math-calculation-inside-elasticsearch-filter-plugin/123581/3 "2018-04-13T16:10:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.