# Timestamp range in elasticsearch **URL:** \ **Category:** Kibana\ **Created:** [February 23, 2016, 10:24am UTC](https://discuss.elastic.co/t/timestamp-range-in-elasticsearch/42482 "2016-02-23T10:24:30Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![lucifer](https://avatars.discourse-cdn.com/v4/letter/l/ad7895/32.png) [@lucifer](https://discuss.elastic.co/u/lucifer)\ **Post date:** [February 23, 2016, 10:24am UTC](https://discuss.elastic.co/t/timestamp-range-in-elasticsearch/42482/1 "2016-02-23T10:24:30Z")
While using ELK Stack for log analysis, there are 2 timestamps. One at which the log enters logstash, and one at which the log is actually generated. How can I apply range filter on the latter? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [February 23, 2016, 6:51pm UTC](https://discuss.elastic.co/t/timestamp-range-in-elasticsearch/42482/2 "2016-02-23T18:51:57Z")
Where are you wanting to apply the filter, in KB? ---
**Author:** ![lucifer](https://avatars.discourse-cdn.com/v4/letter/l/ad7895/32.png) [@lucifer](https://discuss.elastic.co/u/lucifer)\ **Post date:** [February 24, 2016, 9:45am UTC](https://discuss.elastic.co/t/timestamp-range-in-elasticsearch/42482/3 "2016-02-24T09:45:54Z")
Suppose I want to view all the logs, with a particular keyword in a timestamp range. And this timestamp is the one in which the log was actually generated in the first place, and not the one when it entered logstash or elasticsearch. How can I do that? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [February 24, 2016, 6:29pm UTC](https://discuss.elastic.co/t/timestamp-range-in-elasticsearch/42482/4 "2016-02-24T18:29:51Z")
I understand that, but are you running this in Kibana? ---
**Author:** ![lucifer](https://avatars.discourse-cdn.com/v4/letter/l/ad7895/32.png) [@lucifer](https://discuss.elastic.co/u/lucifer)\ **Post date:** [February 25, 2016, 8:18am UTC](https://discuss.elastic.co/t/timestamp-range-in-elasticsearch/42482/5 "2016-02-25T08:18:06Z")
Yes. in Kibana ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [February 25, 2016, 7:18pm UTC](https://discuss.elastic.co/t/timestamp-range-in-elasticsearch/42482/6 "2016-02-25T19:18:02Z")
You could do a query specifically on that field in discover, or you could change the index timestamp field to that one in the index settings. ---
**Author:** ![lucifer](https://avatars.discourse-cdn.com/v4/letter/l/ad7895/32.png) [@lucifer](https://discuss.elastic.co/u/lucifer)\ **Post date:** [February 26, 2016, 5:14am UTC](https://discuss.elastic.co/t/timestamp-range-in-elasticsearch/42482/7 "2016-02-26T05:14:26Z")
Could you please explain with an example? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [February 26, 2016, 7:08pm UTC](https://discuss.elastic.co/t/timestamp-range-in-elasticsearch/42482/8 "2016-02-26T19:08:52Z")
Something like `timestampfield: [2012-01-01 TO 2012-12-31]` should work, just change the `timestampfield` to whatever you want to use. Also I'll move this to the KB section as it's more relevant than here 🙂 ---
**Author:** ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)\ **Post date:** [February 26, 2016, 8:03pm UTC](https://discuss.elastic.co/t/timestamp-range-in-elasticsearch/42482/9 "2016-02-26T20:03:26Z")
You could also check which time field your kibana index pattern is based on. If it's already based on the actual event time, then you can just use the kibana time picker. If you're not sure, you can go to the settings tab, select your index pattern on the top left, and see which field has the little clock shown by it. ![](https://us1.discourse-cdn.com/elastic/original/2X/4/486ad441f191272c7e150816975ef70802d167c8.png) If all the users of this index pattern in your kibana want the same time field you should probably create your index pattern with it. You can also see if there's any difference between the time field that your index pattern is based on and your event time field. Just go to discover tab and click the Add button next to your event time field and you'll see both side-by-side. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 2:00pm UTC](https://discuss.elastic.co/t/timestamp-range-in-elasticsearch/42482/10 "2017-07-06T14:00:56Z")