Issue with timestamp_range_start and timestamp_range_end Dates in XSOAR Elasticsearch Integration Command

MF762 — Mon, 04 Nov 2024 14:07:16 GMT

Problem Description:
The date filtering functionality for start and end dates in the Elasticsearch search command on XSOAR does not seem to be working correctly. The command used is as follows:!es-search index="index-runtime-evts" query="queryTest" timestamp_range_start="-2y" timestamp_range_end="now"I also tried entering a specific timestamp, such as 2023-10-02T00:00:00Z in the timestamp_range_start field, but I keep getting an empty response.Additional Details:

If I omit timestamp_range_start and timestamp_range_end in the War Room/playbook, I can retrieve all logs from the specified index (index-runtime-evts).
However, the goal is to filter the logs based on a 7-day range rather than retrieving the entire index history.

Re: Issue with timestamp_range_start and timestamp_range_end Dates in XSOAR Elasticsearch Integration Command

JakubKostial — Wed, 06 Nov 2024 15:23:04 GMT

Hello,

I use two formats for my !es-search tasks:
1. exact time in format 2024-11-06T14:48:47.149000+00:00
2. key words like in Kibana filtering through time, like "24 hours ago", "3 months ago", etc

Hope this helps.

topic Issue with timestamp_range_start and timestamp_range_end Dates in XSOAR Elasticsearch Integration Command in Cortex XSOAR Discussions

Issue with timestamp_range_start and timestamp_range_end Dates in XSOAR Elasticsearch Integration Command

Re: Issue with timestamp_range_start and timestamp_range_end Dates in XSOAR Elasticsearch Integration Command