# Time Filter in Kibana

**URL:** <https://discuss.elastic.co/t/time-filter-in-kibana/260050>\
**Category:** Kibana\
**Created:** [January 4, 2021, 5:02am UTC](https://discuss.elastic.co/t/time-filter-in-kibana/260050 "2021-01-04T05:02:41Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Amrita\_Mahule](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amrita_mahule/32/76222_2.png) [@Amrita\_Mahule](https://discuss.elastic.co/u/Amrita_Mahule)\
**Post date:** [January 4, 2021, 5:02am UTC](https://discuss.elastic.co/t/time-filter-in-kibana/260050/1 "2021-01-04T05:02:41Z")

</div>

Hi Team,

We have a requirement where we want to customize the time filter on Kibana.

We want that a user can only view data of last 2 days and not older than that. Is there any way to achieve that without deleting the data?

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [January 4, 2021, 5:51am UTC](https://discuss.elastic.co/t/time-filter-in-kibana/260050/2 "2021-01-04T05:51:59Z")

</div>

Yes,

I would create a role with document level security that only show documents gte the last 2 days.

> **[Document level security | Elasticsearch Reference \[7.10\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/document-level-security.html)**

Then I would create a Kibana space and assign those users that role and assign them to that Kibaba space.

Then those users would only be able to access the document you defined

This is a paid feature however.

> **[Subscriptions | Elastic Stack Products & Support | Elastic](https://www.elastic.co/subscriptions)**

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [January 4, 2021, 6:15am UTC](https://discuss.elastic.co/t/time-filter-in-kibana/260050/3 "2021-01-04T06:15:35Z")

</div>

If this is not a hard / security requirement there are perhaps some other ways to limit / make it harder / less obvious ways to view older data, but the only secure way to do it would be with index or document level security.

---

<div class="post-metadata">

**Author:** ![Amrita\_Mahule](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amrita_mahule/32/76222_2.png) [@Amrita\_Mahule](https://discuss.elastic.co/u/Amrita_Mahule)\
**Post date:** [January 4, 2021, 6:40am UTC](https://discuss.elastic.co/t/time-filter-in-kibana/260050/4 "2021-01-04T06:40:12Z")

</div>

Could you please suggest what are some other ways to limit, and less obvious ways to view older data, as we are using non licensed version at the moment and will upgrade when the solution is approved.

---

<div class="post-metadata">

**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\
**Post date:** [January 4, 2021, 9:11am UTC](https://discuss.elastic.co/t/time-filter-in-kibana/260050/5 "2021-01-04T09:11:58Z")

</div>

You can check filtred alias

> **[Update index alias API | Elasticsearch Reference \[7.10\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/7.10/indices-aliases.html#filtered)**

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 1, 2021, 9:12am UTC](https://discuss.elastic.co/t/time-filter-in-kibana/260050/6 "2021-02-01T09:12:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.