# Require Last 15 minutes from timestamp

**URL:** <https://discuss.elastic.co/t/require-last-15-minutes-from-timestamp/332039>\
**Category:** Logstash\
**Created:** [May 1, 2023, 7:46pm UTC](https://discuss.elastic.co/t/require-last-15-minutes-from-timestamp/332039 "2023-05-01T19:46:49Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rubhamra](https://avatars.discourse-cdn.com/v4/letter/r/858c86/32.png) [@rubhamra](https://discuss.elastic.co/u/rubhamra)\
**Post date:** [May 1, 2023, 7:46pm UTC](https://discuss.elastic.co/t/require-last-15-minutes-from-timestamp/332039/1 "2023-05-01T19:46:49Z")

</div>

I have REST API call and I need to pull records which were updated every last 15 minutes.

I can pull last 24 records but I need just updated with in last 15 minutes based on the date field.

This is the ruby code

```auto
ruby {
    code => "event.set('[yesterday]', (Time.now - 86400).strftime('%Y-%m-%dT%H:%M:%S.%N'))"
    }

```

logstash config file (http plugin)

```auto
http {
        id => "ch-id"
        verb => "GET"       
        url => "http://localhost:8080/api/arsys/v1.0/entry/task%20list?q=Changed Date > %{yesterday}"   
        headers => {
            "Authorization" => "%{[@metadata][request][token]}"
            "X-AR-Client-Type" => '34'
        }
        request_timeout => 600
        socket_timeout => 600
        body_format => "json"
        target_body => "[response][body]"
        target_headers => "[response][headers]"
        periodic_flush => true           
    }

```

I need to pull records that were updated with in last 15 minutes based on field **Changed Date**

Thanks

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 1, 2023, 8:16pm UTC](https://discuss.elastic.co/t/require-last-15-minutes-from-timestamp/332039/2 "2023-05-01T20:16:30Z")

</div>

Can't you just change your ruby code to subtract 900 from Time.now instead of 86400?

---

<div class="post-metadata">

**Author:** ![rubhamra](https://avatars.discourse-cdn.com/v4/letter/r/858c86/32.png) [@rubhamra](https://discuss.elastic.co/u/rubhamra)\
**Post date:** [May 3, 2023, 1:42am UTC](https://discuss.elastic.co/t/require-last-15-minutes-from-timestamp/332039/3 "2023-05-03T01:42:09Z")

</div>

Thanks Badger, It was just I couldn't think of that but It working as you said, but this logic is not still good for me.

As you can below see I am calling REST API based on passing ' **Changed Date**' as query parameter to get yesterday data and once you have the all the data from yesterday you can run Logstash every 2 minutes grabbing latest data from last 15 minutes.

but if Logstash stopped or Elasticsearch stopped I need to adjust the time to get all the data since the system is stopped.

I need help on how I can store the last ' **Changed Date** and time' and compare it next time with current time, to grab data from last ' **Changed Date**' which somehow I need to store somewhere.

It's Like what you do with JDBC input plugin and you can store the last sql time in .sql\_last\_value.

Let me know is that possible,

Thanks

```auto
http {
        id => "ch-id"
        verb => "GET"       
        url => "http://localhost:8080/api/arsys/v1.0/entry/task%20list?q=Changed Date > %{yesterday}"   
        headers => {
            "Authorization" => "%{[@metadata][request][token]}"
            "X-AR-Client-Type" => '34'
        }
        request_timeout => 600
        socket_timeout => 600
        body_format => "json"
        target_body => "[response][body]"
        target_headers => "[response][headers]"
        periodic_flush => true           
    }

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 31, 2023, 1:42am UTC](https://discuss.elastic.co/t/require-last-15-minutes-from-timestamp/332039/4 "2023-05-31T01:42:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.