# Quiet servers search

**URL:** <https://discuss.elastic.co/t/quiet-servers-search/78761>\
**Category:** Elasticsearch\
**Created:** [March 15, 2017, 8:04pm UTC](https://discuss.elastic.co/t/quiet-servers-search/78761 "2017-03-15T20:04:02Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![lukejolly](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lukejolly/32/9951_2.png) [@lukejolly](https://discuss.elastic.co/u/lukejolly)\
**Post date:** [March 15, 2017, 8:04pm UTC](https://discuss.elastic.co/t/quiet-servers-search/78761/1 "2017-03-15T20:04:02Z")

</div>

I am trying to write a query that will show what servers have not logged in the last 15 minutes but were logging a day ago. I am using Elasticsearch 5.2. Here is what I have:

```
POST _search
{
  "size":0,
  "query":{
    "bool":{
      "should":[
        {
          "range":{
            "@timestamp":{"gt":"now-15m", "lte":"now"}
          }
        },
        {
          "range":{
            "@timestamp":{"gt":"now-1d-1h", "lte":"now-1d"}
          }
        }
      ]
    }
  },
  "aggs":{
    "what":{
      "terms":{"field":"hostname.keyword"},
      "aggs":{
        "when":{
          "range":{
            "field":"@timestamp",
            "ranges":[
              {"from":"now-1d"},
              {"to":"now-1d"}
            ]
          }
        }
      }
    }
  }
}

```

I have two problems with this. It only returns 10 hosts and all of them have 0 in the bucket that should have the "now-15m" logs. Example:

```
{
  "key": "icarus.11-e.ninja",
  "doc_count": 4174,
  "when": {
    "buckets": [
      {
        "key": "*-2017-03-14T20:02:18.235Z",
        "to": 1489521738235,
        "to_as_string": "2017-03-14T20:02:18.235Z",
        "doc_count": 4174
      },
      {
        "key": "2017-03-14T20:02:18.235Z-*",
        "from": 1489521738235,
        "from_as_string": "2017-03-14T20:02:18.235Z",
        "doc_count": 0
      }
    ]
  }
}

```

I feel like I'm missing a size option somewhere, but I'm not sure.

---

<div class="post-metadata">

**Author:** ![lukejolly](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lukejolly/32/9951_2.png) [@lukejolly](https://discuss.elastic.co/u/lukejolly)\
**Post date:** [March 16, 2017, 4:07pm UTC](https://discuss.elastic.co/t/quiet-servers-search/78761/2 "2017-03-16T16:07:16Z")

</div>

So on further debugging it doesn't always have 'doc\_count: 0' in the second bucket but often does.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 13, 2017, 4:07pm UTC](https://discuss.elastic.co/t/quiet-servers-search/78761/3 "2017-04-13T16:07:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.