Timestamp range in elasticsearch


(lucifer) #1

While using ELK Stack for log analysis, there are 2 timestamps. One at which the log enters logstash, and one at which the log is actually generated. How can I apply range filter on the latter?


(Mark Walkom) #2

Where are you wanting to apply the filter, in KB?


(lucifer) #3

Suppose I want to view all the logs, with a particular keyword in a timestamp range. And this timestamp is the one in which the log was actually generated in the first place, and not the one when it entered logstash or elasticsearch. How can I do that?


(Mark Walkom) #4

I understand that, but are you running this in Kibana?


(lucifer) #5

Yes. in Kibana


(Mark Walkom) #6

You could do a query specifically on that field in discover, or you could change the index timestamp field to that one in the index settings.


(lucifer) #7

Could you please explain with an example?


(Mark Walkom) #8

Something like timestampfield: [2012-01-01 TO 2012-12-31] should work, just change the timestampfield to whatever you want to use.

Also I'll move this to the KB section as it's more relevant than here :slight_smile:


(Lee Drengenberg) #9

You could also check which time field your kibana index pattern is based on. If it's already based on the actual event time, then you can just use the kibana time picker.

If you're not sure, you can go to the settings tab, select your index pattern on the top left, and see which field has the little clock shown by it.

If all the users of this index pattern in your kibana want the same time field you should probably create your index pattern with it.

You can also see if there's any difference between the time field that your index pattern is based on and your event time field. Just go to discover tab and click the Add button next to your event time field and you'll see both side-by-side.


(system) #10