# Time range being ignored

**URL:** https://discuss.elastic.co/t/time-range-being-ignored/153334
**Category:** Elasticsearch
**Created:** [October 22, 2018, 7:29am UTC](https://discuss.elastic.co/t/time-range-being-ignored/153334 "2018-10-22T07:29:43Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![blueren](https://avatars.discourse-cdn.com/v4/letter/b/ecae2f/32.png) [@blueren](https://discuss.elastic.co/u/blueren)
#### Post date: [October 22, 2018, 7:29am UTC](https://discuss.elastic.co/t/time-range-being-ignored/153334/1 "2018-10-22T07:29:43Z")

</div>

I have mimicked how kibana does a query search and have come up with the below query. Basically I'm looking for the lat 6 days of data (including those days where there is no data, since I need to feed it to a graph). But the returned buckets is giving me more than just those days. I woul like to understand where I'm going wring with this.

```
 {
     "version": true,
     "size": 0,
     "sort": [
         {
             "@timestamp": {
                 "order": "desc",
                 "unmapped_type": "boolean"
             }
         }
     ],
     "_source": {
         "excludes": []
     },
     "aggs": {
         "target_traffic": {
             "date_histogram": {
                 "field": "@timestamp",
                 "interval": "1d",
                 "time_zone": "Asia/Kolkata",
                 "min_doc_count": 0,
                 "extended_bounds": {
                     "min": "now-6d/d",
                     "max": "now"
                 }
             },
             "aggs": {
                 "days_filter": {
                     "filter": {
                         "range": {
                             "@timestamp": {
                                 "gt": "now-6d",
                                 "lte": "now"
                             }
                             
                         }
                     },
                     "aggs": {
                         "in_bytes": {
                             "sum": {
                                 "field": "netflow.in_bytes"
                             }
                         },
                         "out_bytes": {
                             "sum": {
                                 "field": "netflow.out_bytes"
                             }
                         }
                     }
                 }
             }
         }
     },
     "stored_fields": [
         "*"
     ],
     "script_fields": {},
     "docvalue_fields": [
         "@timestamp",
         "netflow.first_switched",
         "netflow.last_switched"
     ],
     "query": {
         "bool": {
             "must": [
                 {
                     "query_string": {
                         "query": "( flow.src_addr: ( \"10.5.5.1\" OR \"10.5.5.2\" ) OR flow.dst_addr: ( \"10.5.5.1\" OR \"10.5.5.2\" ) ) AND flow.traffic_locality: \"private\"",
                         "analyze_wildcard": true,
                         "default_field": "*"
                     }
                 }
             ]
         }
     }
 }
```

---

<div class="post-metadata">

### Author: ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [October 22, 2018, 8:34am UTC](https://discuss.elastic.co/t/time-range-being-ignored/153334/2 "2018-10-22T08:34:43Z")

</div>

the time range should be part of the `query` using a [range query](https://www.elastic.co/guide/en/elasticsearch/reference/6.4/query-dsl-range-query.html#_date_format_in_range_queries)

---

<div class="post-metadata">

### Author: ![blueren](https://avatars.discourse-cdn.com/v4/letter/b/ecae2f/32.png) [@blueren](https://discuss.elastic.co/u/blueren)
#### Post date: [October 22, 2018, 8:40am UTC](https://discuss.elastic.co/t/time-range-being-ignored/153334/3 "2018-10-22T08:40:20Z")

</div>

Thanks for this. I've got it working now.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 19, 2018, 8:40am UTC](https://discuss.elastic.co/t/time-range-being-ignored/153334/4 "2018-11-19T08:40:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
