79836000

Date: 2025-12-02 14:52:58
Score: 1
Natty:
Report link

A bit late but maybe this will help others who land here via a web search...

@Val's answer works. However, in my case, Kibana isn't recognizing the syntax with } and { on different lines: I have to keep }{ on the same line. The syntax looks like this (indented for clarity):

GET default*/_msearch
{}{
  "size": 1,
  "query": {
    "bool": {
      "must": [
        { "query_string": { "query": "field1:somevalue*" } },
        { "range": { "@timestamp": { "gte": "now-30m" } } }
      ]
    }
  },
  "sort": {
    "@timestamp": { "order": "desc" }
  }
}{}{
  "size": 1,
  "query": {
    "bool": {
      "must": [
        { "query_string": { "query": "field2:somevalue*" } },
        { "range": { "@timestamp": { "gte": "now-30m" } } }
      ]
    }
  },
  "sort": {
    "@timestamp": { "order": "desc" }
  }
}
Reasons:
  • Long answer (-0.5):
  • Has code block (-0.5):
  • User mentioned (1): @Val's
  • Low reputation (1):
Posted by: Dave