# Copying query doesn't copy group and threshold, only time window

**URL:** <https://discuss.elastic.co/t/copying-query-doesnt-copy-group-and-threshold-only-time-window/365050>\
**Category:** Kibana\
**Created:** [August 16, 2024, 5:06pm UTC](https://discuss.elastic.co/t/copying-query-doesnt-copy-group-and-threshold-only-time-window/365050 "2024-08-16T17:06:26Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![ajtjavier](https://avatars.discourse-cdn.com/v4/letter/a/d78d45/32.png) [@ajtjavier](https://discuss.elastic.co/u/ajtjavier)\
**Post date:** [August 16, 2024, 5:06pm UTC](https://discuss.elastic.co/t/copying-query-doesnt-copy-group-and-threshold-only-time-window/365050/1 "2024-08-16T17:06:26Z")

</div>

I'm trying to copy a query generated by a rule as described on [this thread](https://discuss.elastic.co/t/how-to-alert-based-on-filter-query-count-index-threshold-rule-type/319119), and then convert that JSON to a TOML file for detection as code.

See below the query I've built on Elastic:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/4/34589c1c6730f84ba0025a18de6d14608006ecd2.png)

When I click on _Copy query_, this is the output:

```auto
{
  "aggs": {},
  "fields": [
    {
      "field": "@timestamp",
      "format": "date_time"
    },
    {
      "field": "event.created",
      "format": "date_time"
    },
    {
      "field": "event.ingested",
      "format": "date_time"
    }
  ],
  "script_fields": {},
  "stored_fields": [
    "*"
  ],
  "runtime_mappings": {},
  "_source": {
    "excludes": []
  },
  "query": {
    "bool": {
      "must": [],
      "filter": [
        {
          "bool": {
            "should": [
              {
                "term": {
                  "event.action": {
                    "value": "git.clone"
                  }
                }
              }
            ],
            "minimum_should_match": 1
          }
        },
        {
          "range": {
            "@timestamp": {
              "format": "strict_date_optional_time",
              "gte": "2024-08-16T16:55:01.671Z",
              "lte": "2024-08-16T17:00:01.671Z"
            }
          }
        }
      ],
      "should": [],
      "must_not": []
    }
  }
}

```

There's nothing on copied query that indicates the group and threshold, only the time window. Is there a way to include this?