# Elasticsearch Alerting Watcher count mismatch

**URL:** https://discuss.elastic.co/t/elasticsearch-alerting-watcher-count-mismatch/264417
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [February 16, 2021, 11:10am UTC](https://discuss.elastic.co/t/elasticsearch-alerting-watcher-count-mismatch/264417 "2021-02-16T11:10:26Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![srajus](https://avatars.discourse-cdn.com/v4/letter/s/47e85d/32.png) [@srajus](https://discuss.elastic.co/u/srajus)
#### Post date: [February 16, 2021, 11:10am UTC](https://discuss.elastic.co/t/elasticsearch-alerting-watcher-count-mismatch/264417/1 "2021-02-16T11:10:26Z")

</div>

Hi I am setting up watcher alerts with multi match criteria .I am getting more than 2400+ count but when use the same multi filter criteria in the discover log section i am getting 113 count.  
not sure where exactly i am missing . i am using timestamp query with now-4 hr. please advise.

below is the Json

````auto
"trigger": {
 "schedule": {
   "interval": "1m"
 }
},
"input": {
 "search": {
   "request": {
     "search_type": "query_then_fetch",
     "indices": [
       "json-data*"
     ],
     "rest_total_hits_as_int": true,
     "body": {
       "query": {
         "bool": {
           "must": [
             {
               "match": {
                 "record.dataAssetName": "prod/data/*"
               }
             },
             {
               "match": {
                 "record.is_manifest": "True"
               }
             },
             {
               "match": {
                 "record.status": "Success"
               }
             },
             {
               "range": {
                 "@timestamp": {
                   "gte": "now-4h"
                 }
               }
             }
           ]
         }
       }
     }
   }
 }
},
"condition": {
 "compare": {
   "ctx.payload.hits.total": {
     "gt": 35
   }
 }
},
"actions": {
 "send_email": {
   "email": {
     "profile": "standard",
     "to": [
       "srajus@gmail.com",
       "srajus12345@gmail.com"
     ],
     "subject": "Watcher Notification",
     "body": {
       "text": "SLO has been breached .As of now total {{ctx.payload.hits.total}} reports completed . "
     }
   }
 }
}
}```
````

---

<div class="post-metadata">

### Author: ![srajus](https://avatars.discourse-cdn.com/v4/letter/s/47e85d/32.png) [@srajus](https://discuss.elastic.co/u/srajus)
#### Post date: [February 16, 2021, 10:00pm UTC](https://discuss.elastic.co/t/elasticsearch-alerting-watcher-count-mismatch/264417/2 "2021-02-16T22:00:26Z")

</div>

I have fixed the issue. Issue is with Bool search query. Thanks

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 16, 2021, 10:00pm UTC](https://discuss.elastic.co/t/elasticsearch-alerting-watcher-count-mismatch/264417/3 "2021-03-16T22:00:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.