Query an Elasticsearch index for one field, all documents in last 24 hours?

Hi There.

I'm trying to make a simple get request to my elk index.
I have the right credentials, hostname, index name, etc.
my ELK version is 6.8.6

But for what I'm trying to get I cannot figure out how to construct the GET.

I'm only trying to get 1 field. For all documents in the last 24 hour period.

Any advice I would take, or resources on how to actually form these queries to get this index data.

GET /<index_name>/_search
{
  "query": {
    "range": {
      "@timestamp": {
        "gte": "now-24h",
        "lte": "now"
      }
    }
  },
  "fields": ["<field_name>"]
}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.