# Query last one hour records

**URL:** <https://discuss.elastic.co/t/query-last-one-hour-records/45991>\
**Category:** Elasticsearch\
**Created:** [March 31, 2016, 8:30pm UTC](https://discuss.elastic.co/t/query-last-one-hour-records/45991 "2016-03-31T20:30:48Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vaibhav\_Khanduja](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vaibhav_khanduja/32/8815_2.png) [@Vaibhav\_Khanduja](https://discuss.elastic.co/u/Vaibhav_Khanduja)\
**Post date:** [March 31, 2016, 8:30pm UTC](https://discuss.elastic.co/t/query-last-one-hour-records/45991/1 "2016-03-31T20:30:48Z")

</div>

I am having serious trouble in querying last one hour records and my query with filter "gte" : "now-1h" does not result in any data.

The time on my box is

1459456163

The data of time stamps are in range : 1459455130 to 1459455131 .... The query results no data

GET \_search  
{  
"filter" :{  
"query": {  
"range": {  
"Time": {  
"gte" : "now-1h"  
}  
}  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![MarkOStewart](https://avatars.discourse-cdn.com/v4/letter/m/898d66/32.png) [@MarkOStewart](https://discuss.elastic.co/u/MarkOStewart)\
**Post date:** [March 31, 2016, 8:44pm UTC](https://discuss.elastic.co/t/query-last-one-hour-records/45991/2 "2016-03-31T20:44:02Z")

</div>

You are close Try this: (use timestamp instead of time.)

GET \_search  
{  
"filter" :{  
"query": {  
"range": {  
"timestamp": {  
"gte" : "now-1h"  
}  
}  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [March 31, 2016, 8:52pm UTC](https://discuss.elastic.co/t/query-last-one-hour-records/45991/3 "2016-03-31T20:52:05Z")

</div>

What does your mapping look like?

---

<div class="post-metadata">

**Author:** ![Vaibhav\_Khanduja](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vaibhav_khanduja/32/8815_2.png) [@Vaibhav\_Khanduja](https://discuss.elastic.co/u/Vaibhav_Khanduja)\
**Post date:** [March 31, 2016, 9:21pm UTC](https://discuss.elastic.co/t/query-last-one-hour-records/45991/4 "2016-03-31T21:21:13Z")

</div>

My Mapping is  
{  
"settings": {  
"index.number\_of\_shards": 1,  
"index.number\_of\_replicas": 0  
},  
"mappings": {  
"doc": {  
"\_timestamp": {  
"enabled": "true"  
},  
"properties": {  
"lists" : {  
"properties" : {  
"Values": { "type": "string" }  
}  
},  
"Id" : {  
"type": "string"  
},  
"Status" : {  
"type": "string"  
},  
"From" : {  
"type": "string"  
},  
"Time": {  
"type": "date"  
}  
}  
}  
}  
}

Changing timestamp to Time does not help..

---

<div class="post-metadata">

**Author:** ![Vaibhav\_Khanduja](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vaibhav_khanduja/32/8815_2.png) [@Vaibhav\_Khanduja](https://discuss.elastic.co/u/Vaibhav_Khanduja)\
**Post date:** [March 31, 2016, 9:23pm UTC](https://discuss.elastic.co/t/query-last-one-hour-records/45991/5 "2016-03-31T21:23:36Z")

</div>

This is from querying the mapping

{  
"configlogs": {  
"mappings": {  
"CONTAINER": {  
"properties": {  
"From": {  
"type": "string"  
},  
"Id": {  
"type": "string"  
},  
"Status": {  
"type": "string"  
},  
"Time": {  
"type": "date",  
"format": "strict\_date\_optional\_time||epoch\_millis"  
}  
}  
},  
"VOLUME": {  
"properties": {  
"From": {  
"type": "string"  
},  
"Id": {  
"type": "string"  
},  
"Status": {  
"type": "string"  
},  
"Time": {  
"type": "date",  
"format": "strict\_date\_optional\_time||epoch\_millis"  
}  
}  
},  
"doc": {  
"\_timestamp": {  
"enabled": true  
},  
"properties": {  
"From": {  
"type": "string"  
},  
"Id": {  
"type": "string"  
},  
"Status": {  
"type": "string"  
},  
"Time": {  
"type": "date",  
"format": "strict\_date\_optional\_time||epoch\_millis"  
},  
"lists": {  
"properties": {  
"Values": {  
"type": "string"  
}  
}  
}  
}  
}  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![Vaibhav\_Khanduja](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vaibhav_khanduja/32/8815_2.png) [@Vaibhav\_Khanduja](https://discuss.elastic.co/u/Vaibhav_Khanduja)\
**Post date:** [March 31, 2016, 9:44pm UTC](https://discuss.elastic.co/t/query-last-one-hour-records/45991/6 "2016-03-31T21:44:26Z")

</div>

Looks ... it is problem with the time stamp precision ... a precision of milli seconds ...

1459460126971

---

<div class="post-metadata">

**Author:** ![MarkOStewart](https://avatars.discourse-cdn.com/v4/letter/m/898d66/32.png) [@MarkOStewart](https://discuss.elastic.co/u/MarkOStewart)\
**Post date:** [April 1, 2016, 2:38pm UTC](https://discuss.elastic.co/t/query-last-one-hour-records/45991/7 "2016-04-01T14:38:49Z")

</div>

you could be correct.  
The system may not know how to extract now-1h from epoch in milliseconds.  
I would change the current time to epoch and subtract how many millis are in one hour.

---

<div class="post-metadata">

**Author:** ![Vaibhav\_Khanduja](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vaibhav_khanduja/32/8815_2.png) [@Vaibhav\_Khanduja](https://discuss.elastic.co/u/Vaibhav_Khanduja)\
**Post date:** [April 1, 2016, 4:04pm UTC](https://discuss.elastic.co/t/query-last-one-hour-records/45991/8 "2016-04-01T16:04:24Z")

</div>

I am able to reproduce the issue ...it is about having a mapping with type date and default "format": "strict\_date\_optional\_time||epoch\_millis" and then sending time values which is not milli second precision e.g. 1459456163

---

<div class="post-metadata">

**Author:** ![MarkOStewart](https://avatars.discourse-cdn.com/v4/letter/m/898d66/32.png) [@MarkOStewart](https://discuss.elastic.co/u/MarkOStewart)\
**Post date:** [April 1, 2016, 7:28pm UTC](https://discuss.elastic.co/t/query-last-one-hour-records/45991/9 "2016-04-01T19:28:36Z")

</div>

There may be a way to use an analyzer to change your query into epoch precision so your queries will match your data.  
I am not that good with analyzers.

Anyone else?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 11:03pm UTC](https://discuss.elastic.co/t/query-last-one-hour-records/45991/10 "2017-07-05T23:03:07Z")

</div>