# Elasticsearch Alerts Timing Edge Case

**URL:** <https://discuss.elastic.co/t/elasticsearch-alerts-timing-edge-case/353400>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [February 15, 2024, 4:45pm UTC](https://discuss.elastic.co/t/elasticsearch-alerts-timing-edge-case/353400 "2024-02-15T16:45:10Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![spatel68](https://avatars.discourse-cdn.com/v4/letter/s/7993a0/32.png) [@spatel68](https://discuss.elastic.co/u/spatel68)\
**Post date:** [February 15, 2024, 4:45pm UTC](https://discuss.elastic.co/t/elasticsearch-alerts-timing-edge-case/353400/1 "2024-02-15T16:45:10Z")

</div>

We’re currently using Elasticsearch Alerts to get notified for the number of documents that were ingested each minute. The alert runs on an interval of 1m. We were concerned about timing edge cases since this could lead to inaccurate results. To address this, we rounded down to the beginning of the current minute and the beginning of the last minute. My question is, can there be an issue for an alert that was created at the edge of the minute?

_Normal Working Case_  
So if my alert runs at 09:43:50am, my reverse query will send results between 09:42:00-09:43:00 as expected.  
If my next alert runs at 09:44:51am (off by 1s due to some delay), my reverse query will send results between 09:43:00-09:44:00 as expected.

_Edge Case_  
If my alert runs at 09:43:59am, my reverse query will send results between 09:42:00-09:43:00.  
If my next alert runs at 09:45:00 (off by 1s due to some delay), my reverse query will send results between 09:44:00-09:45:00.  
This skips the documents received between 09:43:00-09:44:00.

Is there anyway to avoid this?

**Configuration** :  
Interval: 1m

```auto
"bool": {
    "must": [
        {
            "range": {
                "ingestionDateTime": {
                    "gte": "now-60s/m",
                    "lt": "now/m"
                }
            }
        }
    ]
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 14, 2024, 4:45pm UTC](https://discuss.elastic.co/t/elasticsearch-alerts-timing-edge-case/353400/2 "2024-03-14T16:45:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.