How to filter the results based on the time in Azure Log Analytics Workspace

Question

I am using the below query to filter the items that are going to expire in < 90 days by subtracting its Expiry date with the current time.

| where ExpiryDate_s = ((todatetime(ExpiryDate_s) - now()) < (90d))

The query is not working as expected though it is printing the expired results as well.

For Example:

I have the below results in the ExpiryDate_s column

I need the output only the items which are going to expire in < 90 days. In this case

Am I missing something here? Any suggestions would be greatly appreciated.

Answer 1

you could try something like this:

datatable(expiry_date:datetime)
[
    datetime(2020-08-06),
    datetime(2020-08-20),
    datetime(2020-08-20),
    datetime(2020-09-28),
    datetime(2020-09-30),
    datetime(2020-09-30),
    datetime(2020-10-19),
    datetime(2020-10-26),
    datetime(2020-11-08),
    datetime(2020-11-23),
    datetime(2020-11-24),
    datetime(2020-11-25),
    datetime(2020-12-04),
    datetime(2020-12-27),
]
| where (expiry_date - now()) between(0d..90d)

-->

| expiry_date   |    |            |
|---------------|----|------------|
| 2020-10-19 00 | 00 | 00.0000000 |
| 2020-10-26 00 | 00 | 00.0000000 |
| 2020-11-08 00 | 00 | 00.0000000 |
| 2020-11-23 00 | 00 | 00.0000000 |
| 2020-11-24 00 | 00 | 00.0000000 |
| 2020-11-25 00 | 00 | 00.0000000 |
| 2020-12-04 00 | 00 | 00.0000000 |
| 2020-12-27 00 | 00 | 00.0000000 |