How do I get filtered events? And save the report

OpenSearch Dashboards Reporting Plugin
1

Hi! Help! Use it in Wasuh. It is necessary to filter events by condition: from 1.01.2024 to 03.19.2024 for the event “User account is blocked (multiple login errors)” in the range from 18:00 to 20:00 and for the user “root”. How to do it?

Dosen’t work:

{
“query”: {
“bool”: {
“filter”: [
{
“range”: {
“@timestamp”: {
“gte”: “now-30d/d”,
“lte”: “now”
}
}
},
{
“term”: {
“data.win.eventdata.TargetUserName.keyword”: “root”
}
},
{
“match”: {

        "rule.description": "User account locked out (multiple login errors)"
      },
"timeframe": {
"from": "18:00:00",
"to": "20:00:00"
        }
    }
  ]
}

}
}