Search logs between timeframe

(elenasarim) #1

Hello. We are trying to run a query that finds logs between 21.00-6.00 (next morning). Is that possible?

Thank you

(Jochen) #2

That’s the whole purpose of the time frame selector above the search field.

(elenasarim) #3

Tthanks for the quick reply. Actually I want the Time frame selector for a psecific timeframe everyday. I dont want ro restrain logs based on specific date. Just time. And get alerted when a query matches between the aforementioned timeframe.


(Jochen) #4

Ah, okay. Got you.

Unfortunately querying specific components of the message “timestamp” field is currently not possible with the query language used by Graylog.

As a workaround, you could split the time component of a message timestamp into individual fields using a pipeline rule and query these individual fields.


When having these individual fields, you could build a query like the following one:

ts_hour:(>=21 AND <=6)

(system) closed #5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.