Elastic search count query

Question

I am trying to find occurences of a specific pattern within a given period of time. I don't get the count for that pattern with Query 1 which has time parameter, but works with Query 2. Can you please if there is any issue with Query 1.

Query 1:

GET/_count?pretty{
  "query": {
    "bool": {
      "must": {
        "query_string": {
          "query": "Stopping PSB: start the yum-updateonboot deamon..."
        }
      },
      "filter": {
        "range": {
          "@timestamp": {
            "gt": "now-1d"
          }
        }
      }
    }
  }
}'  Result: {   **"count" : 0,**   "_shards" : {     "total" : 2287,     "successful" : 2287,     "skipped" : 0,     "failed" : 0   } 

Query 2:

GET/_count?pretty{
  "query": {
    "bool": {
      "must": {
        "query_string": {
          "query": "Stopping PSB: start the yum-updateonboot deamon..."
        }
      }
    }
  }
}Result: {
  "count": 280483,
  "_shards": {
    "total": 2287,
    "successful": 2287,
    "skipped": 0,
    "failed": 0
  }

Answer 1

The date math with days is somewhat confusing.

Use either hours:

{
  "range":{
    "@timestamp":{
      "gt":"now-24h"
    }
  }
}

or gte instead of gt:

{
  "range":{
    "@timestamp":{
      "gte":"now-1d"
    }
  }
}

Update

Use timestamp instead of @timestamp

{
  "query": {
    "bool": {
      "must": {
        "query_string": {
          "query": "Stopping PSB: start the yum-updateonboot deamon..."
        }
      },
      "filter": {
        "range": {
          "timestamp": {
            "gt": "now-1d"
          }
        }
      }
    }
  }
}

due to this and this.