Relative Time Syntax

The documentation explains how to use relative time syntax in LogScale for specifying time intervals and durations, including basic time units (from milliseconds to years), calendar-based units, and advanced anchoring capabilities. The syntax can be used for query time ranges and bucket definitions, with detailed examples showing how to express time periods like "2 hours ago" or "start of last quarter," though some limitations apply for live queries and scheduled searches.

Relative time syntax allows you to specify a time interval as a duration relative to a specific endpoint, typically the current moment ("now"). This syntax is versatile and can be used in various parts of the platform, including:

  • Specifying the time range for a query using the UI or API.

  • Defining the length of the span for buckets when using functions like timeChart() or bucket().

To make specifying a time more flexible, LogScale supports a relative time syntax. This lets you express a simple time duration, rather than specifying two absolute times.

You specify a relative time modifier as a number followed by a word. The following table shows which words you can use:

Time Unit Accepted Values Notes
Milliseconds millisecond, milliseconds, millis, ms  
Seconds second, seconds, s, sec, secs  
Minutes minute, minutes, m, min  
Hours hour, hours, h, hr, hrs  
Days day, days, d Interpreted as 24h in milliseconds
Weeks week, weeks, w Interpreted as 7 days in milliseconds
Months month, months, mon Interpreted as 30 days in milliseconds
Quarters quarter, quarters, q, qtr, qtrs Interpreted as 90 days in milliseconds
Years year, years, y, yr, yrs Interpreted as 365 days in milliseconds

You can include a space character between the number and the unit of time.

Relative Time Syntax Examples

Two hours:

logscale Syntax
2h

Two hours:

logscale Syntax
2 hours

Three weeks:

logscale Syntax
3 weeks

Ten seconds:

logscale Syntax
10s

Ten seconds:

logscale Syntax
10seconds

Regular Expression

This regular expression describes the format:

logscale Syntax
^(\d+) ?(years?
| y
| yrs?
| quarters?
| q
| qtrs?
| months?
| mon
| weeks?
| w
| days?
| d
| hours?
| hr?
| hrs
| minutes?
| m
| min
| seconds?
| s
| secs?
| milliseconds?
| millis
| ms)$