# Time picker in ES|QL query - esql
**URL:** https://discuss.elastic.co/t/time-picker-in-es-ql-query-esql/390631
**Category:** Kibana
**Tags:** esql
**Created:** [September 24, 2026, 9:26am UTC](https://discuss.elastic.co/t/time-picker-in-es-ql-query-esql/390631 "2026-09-24T09:26:54Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@dot-mike](https://discuss.elastic.co/u/dot-mike)
#### Post date: [September 24, 2026, 9:26am UTC](https://discuss.elastic.co/t/time-picker-in-es-ql-query-esql/390631/1 "2026-09-24T09:26:54Z")
Hi community,
I was wondering about a weird behaviour that might catch some people off-guard. How does the time picker affect ES|QL searches?
For example the following query implies a 24-hour search, but yet the data displayed does not indicate so. See screenshot below.
```auto
FROM logs-*
| WHERE @timestamp > NOW() - 24 hours
```
I am wondering, what are some best practices for ES|QL search? Do we need always set time in the time picker or can we rely on filtering with ES|QL? Also is the "LIMIT"-keyword needed? I hit the default 1000 items.
---
### Author:  [@Tortoise](https://discuss.elastic.co/u/Tortoise)
#### Post date: [September 24, 2026, 10:34am UTC](https://discuss.elastic.co/t/time-picker-in-es-ql-query-esql/390631/2 "2026-09-24T10:34:28Z")
Hello @dot-mike
When the index has an `@timestamp` field, Kibana always applies the time picker as an extra filter on top of your ES|QL query. The two are ANDed, so you only get the overlap. For example, with the picker on "Last 15 minutes", `WHERE @timestamp > NOW() - 24 hours` returns only 15 minutes of data. Either widen the picker, or drop the hard-coded window and reference the picker directly:
```auto
FROM apm-*,logs-*.otel-*,logs-apm*,metrics-*.otel-*,metrics-apm*,traces-*.otel-*,traces-apm*
| WHERE @timestamp >= ?_tstart AND @timestamp < ?_tend
```
Limit is always there by default to 1000 so that is not needed , if you want more or less records than 1000 than LIMIT should be used with maximum default till 10000.
Thanks!!
---
### Author:  [@dot-mike](https://discuss.elastic.co/u/dot-mike)
#### Post date: [September 25, 2026, 1:55pm UTC](https://discuss.elastic.co/t/time-picker-in-es-ql-query-esql/390631/3 "2026-09-25T13:55:30Z")
Many thanks for the quick reply. I believe `WHERE @timestamp >= ?_tstart AND @timestamp < ?_tend` is the solution here. I just wish this wasn't the case...