Query within a specific time window

Elastic Stack Elasticsearch
1

Hi all,

I don't know if it's possible within the DSL query capabilities but would love to get some ideas or answers if it is.
I want to write a query that matches two different documents within a time frame of, say, 15 minutes.
The analogy is, looking for a causal relationship that wrapped in a finite time frame. "If P is true, then Q is also true".

I'll give a simple example from the world I'm coming from so I won't ruin the analogy:
I want to find two documents that comes in a gap of 15 minutes, that obey the following demands:

  1. "Name": "Malicious Command Line"
  2. "Name": "Malicious File Created"

Please notice that it's not a filter query of a time range relative to now-15m but any 15 minutes in the past 24 hours for example.

I hope I described properly my problem, and hope even better that there's a solution for such a problem.

Thanks!

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.