Elasticsearch time-range query and data
This query will return the documents from last 1 hr:
{ "query": { "range": { "@timestamp": { "gte": "now-1h", "lt": "now" } } } }This query will return the documents where tag is blocked and is from last 1hr:
{ "query": { "bool": { "must": [ { "match": { "tags": "blocked" } }, { "range": { "@timestamp": { "gte": "now-1h", "lte": "now" } } } ] } }}You can limit the data to be returned using _source.
This query will only return the ipv4address:
{ "_source": "ipv4address", "query": { "bool": { "must": [ { "match": { "tags": "blocked" } }, { "range": { "@timestamp": { "gte": "now-1h", "lte": "now" } } } ] } }}If you want to apply more queries have a look at this.