# Subtracting time in elasticsearch query
**URL:** https://discuss.elastic.co/t/subtracting-time-in-elasticsearch-query/67512
**Category:** Elasticsearch
**Created:** [November 29, 2016, 3:41pm UTC](https://discuss.elastic.co/t/subtracting-time-in-elasticsearch-query/67512 "2016-11-29T15:41:38Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Mahdy\_S](https://discuss.elastic.co/u/Mahdy_S)
#### Post date: [November 29, 2016, 3:41pm UTC](https://discuss.elastic.co/t/subtracting-time-in-elasticsearch-query/67512/1 "2016-11-29T15:41:38Z")
If I want to query event in a "relative" time window, I can do it in elasticsearch if my reference point is the current time "now". So I can say I want to query documents in the last 24 hours by sending the following query:
> ```
> GET _search
> {
> "query" : {
> "range":{
> "@timestamp" : {
> "gte":"now-1d",
> "lt":"now"
> }
> }
> }
> }
>
> ```
However, I can't find a way to do this based on a timestamp that I can specify. So what I need is something similar to e.g. `{"gte":"2016-11-13T18:35:08.219Z-1d","lt":"2016-11-13T18:35:08.219Z"}`. Is there any query format which makes this possible?
---
### Author:  [@nik9000](https://discuss.elastic.co/u/nik9000)
#### Post date: [November 29, 2016, 7:04pm UTC](https://discuss.elastic.co/t/subtracting-time-in-elasticsearch-query/67512/2 "2016-11-29T19:04:10Z")
It looks like you can replace `now` with a date string ending in `||`. So says the [docs](https://www.elastic.co/guide/en/elasticsearch/reference/current/common-options.html#date-math). So I expect `"gte":"2016-11-13T18:35:08.219Z||-1d","lt":"2016-11-13T18:35:08.219Z"}` to work.
---
### Author:  [@Mahdy\_S](https://discuss.elastic.co/u/Mahdy_S)
#### Post date: [November 30, 2016, 7:55am UTC](https://discuss.elastic.co/t/subtracting-time-in-elasticsearch-query/67512/3 "2016-11-30T07:55:28Z")
Yes this works. Thanks a lot! 🙂
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 28, 2016, 7:55am UTC](https://discuss.elastic.co/t/subtracting-time-in-elasticsearch-query/67512/4 "2016-12-28T07:55:37Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.