Time based search in Kibana discover or visualize

chinmoyd · November 23, 2015, 7:10am

I have a time stamp field ( name is timestamp ) in my list of fields in Kibana index. I need to set a filter as below:
Display all the transactions between 2015-11-23 10:11:23 and 2015-11-23 10:50:33

Please suggest what filter do I need to set in Kibana while designing my Search in discover tab

Regards,
Chinmoy das

warkolm · November 24, 2015, 3:53am

Are you setting the time field in the index settings as the one in the in the doc you want to filter on?

chinmoyd · November 24, 2015, 4:14am

My use case is as below:
I am logging payment transaction data with the details as transaction id, amount, bank, status, timestamp. I have not specified and special setting for the timestamp field while creating the index. I need to filter the records based on a timestamp range. I could find some example where filtering is done by date, but could not trace anything for timestamp. Please suggest how this is possible to filter using timestamp using Kibana.

warkolm · November 25, 2015, 6:53am

When you create the index pattern in KB, make sure you set the timestamp field to be the one in the document.
Then it'll be simple.

chinmoyd · November 25, 2015, 12:43pm

The timestamp field is in the index. Can you please share the syntax of the query filter that I need to add in Kibana Discover? I am trying like timestamp: {2015-11-04 11:12:13 TO 2015-11-04 11:20:20}. But that is not working

chinmoyd · November 26, 2015, 9:53am

Any pointer to the search syntax will be helpful.

Pieter_Agenbag · November 26, 2015, 3:36pm

just use timestamp: ["2015-11-04T11:12:13" TO "2015-11-04T11:20:20"] .

But as @warkolm said, you should be specifying your index (in kibana settings) as a timestamped index.

Then you'll have a histogram at the top of the discover page and you can simply scrub the graph to filter on a timerange.

And there will also be a "time selector" in the toolbar.

chinmoyd · November 27, 2015, 5:56pm

Thanks a lot Pieter