How to do a time range search in Kibana

elasticsearch logstash kibana kibana-4
markus picture markus · May 22, 2015 · Viewed 27.1k times · Source

We are using the ELK for log aggregation. Is it possible to search for events that occured during a particular time range. Lets say I want to see all exceptions that occurred between 10am and 11am in last month.

Is it possible to extract the time part from @timestamp and do a range search on that somehow (similiar to date() in SQL)?

Answer

markus picture markus · May 27, 2015

Thanks to Magnus who pointed me to looking at scripted fields. Take a look at: https://www.elastic.co/blog/kibana-4-beta-3-now-more-filtery

or

https://www.elastic.co/guide/en/elasticsearch/reference/1.3/search-request-script-fields.html

Unfortunately you can not use these scripted fields in queries but only in visualisations.

So I resorted to a workaround and use logstashs drop filter to remove the events I don't want to show up in Kibana in the first-place. That is not perfect for obvious reasons but it does the job.

Related questions

Calculating time between events

I have a message that flows through several systems, each system logs message entry and exit with a timestamp and a uuid messageId. I'm ingesting all logs through: filebeat --> logstash --> elastic search --> kibana As …

Read More
How to retrieve unique count of a field using Kibana + Elastic Search

Is it possible to query for a distinct/unique count of a field using Kibana? I am using elastic search as my backend to Kibana. If so, what is the syntax of the query? Heres a link to the Kibana …

Read More
Logstash date parsing as timestamp using the date filter

Well, after looking around quite a lot, I could not find a solution to my problem, as it "should" work, but obviously doesn't. I'm using on a Ubuntu 14.04 LTS machine Logstash 1.4.2-1-2-2c0f5a1, and I am …

Read More