title: Elasticsearch time-range query and data
body: <p>I am struggling to formulate the right API search call for Elastic Search that will ask for ipv4address that I want in last 1 hour. </p>
  
  <p><strong>First attempt:</strong></p>
  
  <pre><code>curl -X GET "localhost:9200/ipaddresses/_search" -H 'Content-Type: application/json' -d'
       {
         "query": {
           "match": {
             "ipv4address": {
               "query": "50.167.71.25"
             }
           }
         },
         "range": {
           "@timestamp": {
             "gte": "now-1h",
             "lt": "now"
           }
         }
       }
       '
  </code></pre>
  
  <blockquote>
    <p>{"error":{"root_cause":[{"type":"parsing_exception","reason":"Unknown
    key for a START_OBJECT in
    [range].","line":10,"col":12}],"type":"parsing_exception","reason":"Unknown
    key for a START_OBJECT in [range].","line":10,"col":12},"status":400}</p>
  </blockquote>
  
  <p><strong>Second attempt:</strong></p>
  
  <pre><code>curl -X GET "localhost:9200/ipaddresses/_search" -H 'Content-Type: application/json' -d'
  {
     "query": {
       "match": {
         "ipv4address": {
           "query": "50.167.71.25"
         }
       }
     },
     "fields": {
      "range": {
       "@timestamp": {
        "gte": "now-1h",
        "lt": "now"
       }
     }
    }
   }
   '
  </code></pre>
  
  <blockquote>
    <p>{"error":{"root_cause":[{"type":"parsing_exception","reason":"Unknown
    key for a START_OBJECT in
    [fields].","line":10,"col":14}],"type":"parsing_exception","reason":"Unknown
    key for a START_OBJECT in [fields].","line":10,"col":14},"status":400}</p>
  </blockquote>
  
  <p><strong>What I have in Kibana:</strong></p>
  
  <pre><code>{
    "_index": "ipaddresses",
    "_type": "default",
    "_id": "TJdvR2UB9sEBYW4CrElF",
    "_version": 1,
    "_score": null,
    "_source": {
      "tags": [
        "blocked",
        "ipv4_address",
      ],
      "@version": "1",
      "@timestamp": "2018-08-17T10:30:25.118Z",
      "ipv4_metadata": {
        "host": "elk",
        "name": "blocks",
        "response_message": "OK",
        "code": 200,
        "times_retried": 0,
        "runtime_seconds": 0.066403,
        "response_headers": {
          "connection": "keep-alive",
          "x-frame-options": "sameorigin",
          "last-modified": "Fri, 17 Aug 2018 10:28:06 GMT",
          "keep-alive": "timeout=20",
          "date": "Fri, 17 Aug 2018 10:28:20 GMT",
          "content-type": "text/plain; charset=UTF-8",
          "server": "nginx/1.12.2",
          "transfer-encoding": "chunked",
          "etag": "W/\"5c7c5-5739f03f2997f\"",
          "cache-control": "public"
        }
      },
      "ipv4address": "50.167.71.25",
      "message": "50.167.71.25"
    },
    "fields": {
      "@timestamp": [
        "2018-08-17T10:30:25.118Z"
      ]
    },
    "sort": [
      1534501825118
    ]
  }
  </code></pre>
  
  <p>What is wrong with the query?
  What if I would like to look as well for a "tag" field that equals  blocked?</p>
  
  <p>Please help me to connect the dots.</p>