Time range based on timestamp in DSL query

[stephenb (Stephen Brown)]

Hi @LeCalve Welcome to the community.

You are going to need to create a field that represents time of day and then filter on it

I just help someone with this. You can read what we did here

Extracting time from @timestamp field using Runtime

I understand Scripted Fields have been deprecated since 7.13. The replacement is now Runtime. I have a @timestamp field [image] How can I extract out the time component into a new field @timeofday - such that when I filter by @timeofday, I can filter by time range. I was reading Lucene Expressions Language | Elasticsearch Guide [5.0] | Elastic and But still feel abit lost on how complicated an approach I need to do. Its actually a simple mod because I'm relying on data in existing colu…

This is doing it with runtime fields. In order to use this for a DSL query You will need to add the runtime field directly to the mapping or you may want to actually use an ingest pipeline and create a field on ingest.

Take a read and come back. Tell us what you think.