Kibana: Support relative date range queries

[mradamlacey]

I think it would be useful to allow relative date range queries in Kibana in format like the following:

timestamp_field:[now-3m TO now]

Which would filter results where timestamp_field is between 3 months ago and the current time.

Another example:

timestamp_field:[now-1y TO now-1m]

filters from 1 year ago to 1 month ago.

My understanding that currently Kibana only allows date filter where the value for the dates is in the Unix Epoch format (number of milliseconds since Unix epoch).

e.g.:

timestamp_field:[1434560779 TO 1434647179]

[spalger]

Kibana currently supports the lucene query string syntax via elasticsearch's query string query which is why timestamp_field:[ms to ms] works but relative time ranges do not.

KIbana does however have the timepicker at the top right of the app that is enabled when you tell kibana about the existance of the timestamp field in your index pattern (see step two here). This timepicker not only helps define relative time filters, but also allows you to move the time window for everything on a page in a unified way, so it is generally prefered to specifying a filter directly in the query.

[mradamlacey]

That's not exactly what I'm looking for.

In the case that a type I want to visualize has multiple timestamp fields, and I want to filter based on the range of one, and then visualize something else with an aggregation on the other.

Imagine I want to just hide any data older than a year for field timestamp_1 in one visualization, but maybe I want to hide data older than 3 months for field timestamp_2 in another visualization.

basically looking for something that does not operate at a global level.

[spalger]

I imagine that could be useful in some scenarios. At this time it would require changing the query string syntax (which means the ticket should be moved to elasticsearch) or supporting multiple time filters. Reopening as an enhancement

[tcucchietti]

+1 : would be especially useful when you want to a vizualization to be based only on last year/month/week values while displaying values from a wider timeframe in another vizualization, which is not possible with the timepicker (which changes the timeframe for all vizualizations at once)

[hilocark]

I love this enhancement too. In my point of view, kind of timepicker independently for each virtualization may help, which is possibly more easy to support.

[vitalibertas]

+1 You could do this in Kibana 3. It becomes very frustrating having to go backwards in functionality with Kibana 4.

[swackhamer]

+1
I have a use case where I have multiple timestamps and I want to visualize just the last day in a dashboard for a separate date then the one that is "tied" to the Kibana index that the timepicker uses.

[stevenswinbank]

This would be really helpful for me too. I only want to show something if it's within X seconds of NOW

[tbragin]

@mradamlacey This seems similar to what is being described in https://github.com/elastic/kibana/issues/3578, could you confirm? If so, it might be valuable to unify comments in a single thread.

[LionelClaudon]

+1
Like every one else, the date picker feature is not appropriate in the case where some of our visualization only need a specific relative date range, and not all the dashboard. I would really appreciate such feature also.

[gangding]

It works for me for such thing like: timestamp_field:[now-1d TO now]
version 5.x

[gawainedwards]

+1

[loekvangool]

Confirmed that this works in Kibana 5.2:

@timestamp:[now-1d TO now]

This only works with capital TO, lowercase now, and use 1d, not 1day or 1days. This is different than the Lucene syntax documented elsewhere. If you get a Failed to parse query error, check your syntax.

Propose to close.