# Does ctx.trigger.scheduled\_time and ctx.execution\_time parse correctly in the watch query?

**URL:** <https://discuss.elastic.co/t/does-ctx-trigger-scheduled-time-and-ctx-execution-time-parse-correctly-in-the-watch-query/31896>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [October 9, 2015, 8:02am UTC](https://discuss.elastic.co/t/does-ctx-trigger-scheduled-time-and-ctx-execution-time-parse-correctly-in-the-watch-query/31896 "2015-10-09T08:02:11Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Enniu\_51](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/enniu_51/32/5310_2.png) [@Enniu\_51](https://discuss.elastic.co/u/Enniu_51)\
**Post date:** [October 9, 2015, 8:02am UTC](https://discuss.elastic.co/t/does-ctx-trigger-scheduled-time-and-ctx-execution-time-parse-correctly-in-the-watch-query/31896/1 "2015-10-09T08:02:11Z")

</div>

I run,

```
curl -XGET 'http://localhost:9200/.watch_history*/_search?pretty' -d '{
  "sort" : [
    { "result.execution_time" : "desc" }
  ]
}'

```

and get:

```
{
  "took" : 2,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "failed" : 0
  },
  "hits" : {
    "total" : 158,
    "max_score" : null,
    "hits" : [ {
      "_index" : ".watch_history-2015.10.09",
      "_type" : "watch_record",
      "_id" : "error-code-watch_0-2015-10-09T07:50:00.428Z",
      "_score" : null,
      "_source":{"watch_id":"error-code-watch","state":"execution_not_needed","trigger_event":{"type":"schedule","triggered_time":"2015-10-09T07:50:00.428Z","schedule":{"scheduled_time":"2015-10-09T07:50:00.000Z"}},"input":{"search":{"request":{"search_type":"query_then_fetch","indices":["logstash*"],"types":[],"body":{"query":{"filtered":{"query":{"query_string":{"query":"error_code:*","analyze_wildcard":true}},"filter":{"bool":{"must":[{"range":{"date":{"from":"{{ctx.trigger.scheduled_time}}","to":null,"include_lower":false,"include_upper":true}}},{"range":{"date":{"from":null,"to":"{{ctx.execution_time}}","include_lower":true,"include_upper":false}}}]}}}}},"indices_options":{"expand_wildcards":"open","ignore_unavailable":false,"allow_no_indices":true}}}},"condition":{"script":{"inline":"ctx.payload.hits.total > 0"}},"messages":[],"result":{"execution_time":"2015-10-09T07:50:00.428Z","execution_duration":3,"input":{"type":"search","status":"success","payload":{"_shards":{"total":5,"failed":0,"successful":5},"hits":{"hits":[],"total":0,"max_score":null},"took":2,"timed_out":false},"search":{"request":{"search_type":"query_then_fetch","indices":["logstash*"],"types":[],"template":{"template":{"query":{"filtered":{"query":{"query_string":{"query":"error_code:*","analyze_wildcard":true}},"filter":{"bool":{"must":[{"range":{"date":{"from":"{{ctx.trigger.scheduled_time}}","to":null,"include_lower":false,"include_upper":true}}},{"range":{"date":{"from":null,"to":"{{ctx.execution_time}}","include_lower":true,"include_upper":false}}}]}}}}},"params":{"ctx":{"metadata":null,"watch_id":"error-code-watch","id":"error-code-watch_0-2015-10-09T07:50:00.428Z","trigger":{"triggered_time":"2015-10-09T07:50:00.428Z","scheduled_time":"2015-10-09T07:50:00.000Z"},"vars":{},"execution_time":"2015-10-09T07:50:00.428Z"}}},"indices_options":{"expand_wildcards":"open","ignore_unavailable":false,"allow_no_indices":true}}}},"condition":{"type":"script","status":"success","met":false},"actions":[]}},
      "sort" : [1444377000428]
    }
...

```

Please notice:

```
{"range":{"date":{"from":"{{ctx.trigger.scheduled_time}}","to":null,"include_lower":false,"include_upper":true}}},{"range":{"date":{"from":null,"to":"{{ctx.execution_time}}","include_lower":true,"include_upper":false}}}

```

Does `{{ctx.trigger.scheduled_time}}` and `{{ctx.execution_time}}` occurs here means they are not parse correctly?

BTW, I use the code from documents to build `SearchRequest`:

```
SearchRequest request = Requests.searchRequest("logstash*").source(searchSource()
                .query(filteredQuery(queryStringQuery("error_code:*").analyzeWildcard(true), boolFilter()
                        .must(rangeFilter("date").gt("{{ctx.trigger.scheduled_time}}"))
                        .must(rangeFilter("date").lt("{{ctx.execution_time}}")))));
```

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [October 9, 2015, 9:37am UTC](https://discuss.elastic.co/t/does-ctx-trigger-scheduled-time-and-ctx-execution-time-parse-correctly-in-the-watch-query/31896/2 "2015-10-09T09:37:39Z")

</div>

Hey,

this logging behaviour is correct, because you are not seeing the executed request but a template search request. If you pretty print the JSON you can see the following

```json
template: {
  template: {
    query: {
      filtered: {
        query: { query_string: { query: "error_code:*", analyze_wildcard: true } },
        filter: {
        bool: {
            must: [
              {
                range: {
                  date: {
                    from: "{{ctx.trigger.scheduled_time}}",
                    to: null,
                    include_lower: false,
                    include_upper: true
                  }
                }
              },
              {
                range: {
                  date: {
                    from: null,
                    to: "{{ctx.execution_time}}",
                    include_lower: true,
                    include_upper: false
                  }
                }
              }
            ]
          }
        }
      }
    }
  },
  params: {
    ctx: {
      metadata: null,
      watch_id: "error-code-watch",
      id: "error-code-watch_0-2015-10-09T07:50:00.428Z",
      trigger: {
        triggered_time: "2015-10-09T07:50:00.428Z",
        scheduled_time: "2015-10-09T07:50:00.000Z"
      },
      vars: { },
      execution_time: "2015-10-09T07:50:00.428Z"
    }
  }
}

```

You can use this as a query by using the `/_search/template` endpoint.

The reason why this might not work, is that you seem to search in a time window of 428 milliseconds - not sure if you intended to do so.

--Alex

---

<div class="post-metadata">

**Author:** ![Enniu\_51](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/enniu_51/32/5310_2.png) [@Enniu\_51](https://discuss.elastic.co/u/Enniu_51)\
**Post date:** [October 9, 2015, 9:42am UTC](https://discuss.elastic.co/t/does-ctx-trigger-scheduled-time-and-ctx-execution-time-parse-correctly-in-the-watch-query/31896/3 "2015-10-09T09:42:09Z")

</div>

Thanks for your detailed reply!

I have noticed my time interval is really small, but that code is from elasticsearch official docs. I think the code should be refine so that it will make sense for beginners.

Please see:

[https://www.elastic.co/guide/en/watcher/current/api-java.html#api-java-put-watch](https://www.elastic.co/guide/en/watcher/current/api-java.html#api-java-put-watch)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:48pm UTC](https://discuss.elastic.co/t/does-ctx-trigger-scheduled-time-and-ctx-execution-time-parse-correctly-in-the-watch-query/31896/4 "2017-07-06T13:48:25Z")

</div>