I have a watcher that executes every 1 minute.
Yesterday, I received an alert from the Watcher and checked if anything wrong. Then I figured out that the watcher didn't execute for 12 hours (5pm-5am). And the first execution triggered an alert.
However, when I run the scripts defined in the watcher in DevTools, filtered with the same time, I didn't see anything wrong.
For more information, the watcher will trigger alerts when aggregations.count.value < 0. The error in the execution history is due to timeout since the ES cluster is probably overloaded at that time.