Hi community,
I was wondering about a weird behaviour that might catch some people off-guard. How does the time picker affect ES|QL searches?
For example the following query implies a 24-hour search, but yet the data displayed does not indicate so. See screenshot below.
FROM logs-*
| WHERE @timestamp > NOW() - 24 hours
I am wondering, what are some best practices for ES|QL search? Do we need always set time in the time picker or can we rely on filtering with ES|QL? Also is the "LIMIT"-keyword needed? I hit the default 1000 items.
Hello @dot-mike
When the index has an @timestamp field, Kibana always applies the time picker as an extra filter on top of your ES|QL query. The two are ANDed, so you only get the overlap. For example, with the picker on "Last 15 minutes", WHERE @timestamp > NOW() - 24 hours returns only 15 minutes of data. Either widen the picker, or drop the hard-coded window and reference the picker directly:
FROM apm-*,logs-*.otel-*,logs-apm*,metrics-*.otel-*,metrics-apm*,traces-*.otel-*,traces-apm*
| WHERE @timestamp >= ?_tstart AND @timestamp < ?_tend
Limit is always there by default to 1000 so that is not needed , if you want more or less records than 1000 than LIMIT should be used with maximum default till 10000.
Thanks!!
Many thanks for the quick reply. I believe WHERE @timestamp >= ?_tstart AND @timestamp < ?_tend is the solution here. I just wish this wasn't the case...
