# Query not working when using timestamp filter

**URL:** <https://forum.opensearch.org/t/query-not-working-when-using-timestamp-filter/639>\
**Category:** Alerting\
**Created:** [May 8, 2019, 2:53pm UTC](https://forum.opensearch.org/t/query-not-working-when-using-timestamp-filter/639 "2019-05-08T14:53:14Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jberto78](https://avatars.discourse-cdn.com/v4/letter/j/5fc32e/32.png) [@jberto78](https://forum.opensearch.org/u/jberto78)\
**Post date:** [May 8, 2019, 2:53pm UTC](https://forum.opensearch.org/t/query-not-working-when-using-timestamp-filter/639/1 "2019-05-08T14:53:14Z")

</div>

Hello there,  
I’m new to using open-distro alerting with my AWS Elasticsearch cluster. I’m trying to set up a query to return how many 200 status code values for a certain timeframe. Below is the query I am using, when using the filter in the query I get zero hits. If I remove the timestamp filter I get hits from the query.

I there a different string or query to use for the timestamp when using open-distro?

```
{
"size": 0,
"query": {
    "match": {
        "sc_status": {
            "query": "200",
            "operator": "OR",
            "prefix_length": 0,
            "max_expansions": 50,
            "fuzzy_transpositions": true,
            "lenient": false,
            "zero_terms_query": "NONE",
            "auto_generate_synonyms_phrase_query": true,
            "boost": 1
        }
    },
    "filter": {
        "range": {"@timestamp":{"gte": "<{now-5m}>"}}
}}}

```

---

<div class="post-metadata">

**Author:** ![dbbaughe](https://avatars.discourse-cdn.com/v4/letter/d/bbe5ce/32.png) [@dbbaughe](https://forum.opensearch.org/u/dbbaughe)\
**Post date:** [May 8, 2019, 5:25pm UTC](https://forum.opensearch.org/t/query-not-working-when-using-timestamp-filter/639/2 "2019-05-08T17:25:13Z")

</div>

Hi @jberto78,

We do provide the parameters {{period\_start}} and {{period\_end}} which represents the schedule period of the monitor.

I’d suggest double checking your mappings to make sure you have a @timestamp field on the documents you’re querying along with pasting the query in Kibana Dev Tools to verify your query is correct. You could remove the match: sc\_status and try just your range query to debug the issue better.

---

<div class="post-metadata">

**Author:** ![jberto78](https://avatars.discourse-cdn.com/v4/letter/j/5fc32e/32.png) [@jberto78](https://forum.opensearch.org/u/jberto78)\
**Post date:** [May 8, 2019, 7:42pm UTC](https://forum.opensearch.org/t/query-not-working-when-using-timestamp-filter/639/3 "2019-05-08T19:42:41Z")

</div>

@dbbaughe - Thanks for the feedback, I found what I was doing wrong, it had to do with how I was doing the now-5m in the query. I changed it to “gte”: “now-15m” (removing the \<{}\>) and I was able to get the results both from Kibana DevTools and from the alerting.

Thanks.

---

<div class="post-metadata">

**Author:** ![skkosuri-amzn](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/skkosuri-amzn/32/935_2.png) [@skkosuri-amzn](https://forum.opensearch.org/u/skkosuri-amzn)\
**Post date:** [August 31, 2020, 10:48pm UTC](https://forum.opensearch.org/t/query-not-working-when-using-timestamp-filter/639/4 "2020-08-31T22:48:48Z")

</div>