A few folks have asked me if it is possible to do timestamp ranges by using "now" in kql. This was missing from an example so I have added it to the docs. (cherry picked from commit 48df620b1d30a9dcd08423204b66b453e50e587b) Co-authored-by: Alex Close <alex.close@elastic.co>
This commit is contained in:
parent
c7dac6502a
commit
767cb55bfa
|
@ -111,11 +111,11 @@ tags:(success and info and security)
|
|||
[discrete]
|
||||
=== Range queries
|
||||
|
||||
KQL supports `>`, `>=`, `<`, and `<=`. For example:
|
||||
KQL supports `>`, `>=`, `<`, and `<=` on numeric and date types. For example:
|
||||
|
||||
[source,yaml]
|
||||
-------------------
|
||||
account_number >= 100 and items_sold <= 200
|
||||
account_number >= 100 and items_sold <= 200 and @timestamp >= now-5m
|
||||
-------------------
|
||||
|
||||
[discrete]
|
||||
|
|
Loading…
Reference in a new issue