How to search today only data in Graylog

Question

I found that it's extremely hard to search "today-only" message in Graylog. Here is what I've tried so far:

1. Using keyword: today 00:00:00 +0800 to today 23:59:59 +0800
2. Using timestamp:["now/d" to "now+1d/d"] in query and select search all messages

None of them is working! :(

Does anyone have a working solution that can save my day? Thank you!

Answer 1

Keywords are parsed by Natty. You can use the keyword today midnight to achieve what you want.

Answer 2

Use the absolute time.

Something like:

http://10.10.10.10:9000/search?q=&rangetype=absolute&from=2020-12-23T20%3A31%3A58.620Z&to=2020-12-23T20%3A36%3A58.621Z

Of course, it is much easier if you use the GUI.