this is the query I was using
POST logs-*/_search
{“query”: {
“bool”: {
“must”: ,
“filter”: [
{
“match_all”: {}
},
{
“match_phrase”: {
“user.name”: “system”
}
},
{
“range”: {
“@timestamp”: {
“gte”: “now-10m”,
“lte”: “now”,
“format”: “strict_date_optional_time”
}
}
}
],
“should”: ,
“must_not”:
}
}}
In this form, I didn’t get any hits but when I give the full-time date instead of the now and now-10m it is getting hits.
Please help