# Elasticsearch watcher error for RANGE query

**URL:** <https://discuss.elastic.co/t/elasticsearch-watcher-error-for-range-query/70347>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [January 2, 2017, 10:13am UTC](https://discuss.elastic.co/t/elasticsearch-watcher-error-for-range-query/70347 "2017-01-02T10:13:25Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dixon\_Almeida](https://avatars.discourse-cdn.com/v4/letter/d/ccd318/32.png) [@Dixon\_Almeida](https://discuss.elastic.co/u/Dixon_Almeida)\
**Post date:** [January 2, 2017, 10:13am UTC](https://discuss.elastic.co/t/elasticsearch-watcher-error-for-range-query/70347/1 "2017-01-02T10:13:25Z")

</div>

hi everyone . It would be helpful if someone can help me with this  
PUT \_xpack/watcher/watch/log\_error\_watch  
{  
"trigger": {  
"schedule": {  
"interval": "10s"  
}  
},  
"input": {  
"search": {  
"request": {  
"indices": [  
"filebeat-2017.01.02"  
],  
"body": {  
"sort": [  
{  
"@timestamp": {  
"order": "desc"  
}  
}  
],

```
      "query": {
        "range": {
          "offset": {
            "gte": 1000,
            "lte": 2000
          }
        }, 

        "match": {
          "source": "/var/log/apache2/access.log"
        }
      },
      "size": 5
    }
  }
}

```

}  
}

o.e.m.j.JvmGcMonitorService] [hj-test156] [gc][11042] overhead, spent [701ms] collecting in the last [1s] [2017-01-02T15:32:04,311][ERROR][o.e.x.w.i.s.ExecutableSimpleInput] [hj-test156] failed to execute [search] input for watch [log\_error\_watch], reason [[range] malformed query, expected [END\_OBJECT] but found [FIELD\_NAME]]

---

<div class="post-metadata">

**Author:** ![nick.e](https://avatars.discourse-cdn.com/v4/letter/n/8dc957/32.png) [@nick.e](https://discuss.elastic.co/u/nick.e)\
**Post date:** [January 2, 2017, 10:28am UTC](https://discuss.elastic.co/t/elasticsearch-watcher-error-for-range-query/70347/2 "2017-01-02T10:28:40Z")

</div>

Hey,

you should use the [bool-query](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-bool-query.html) to combine the range and match queries.

The part of the query then should look like the following:

```
"query": {
        "bool": {
          "must": [
            {
              "range": {
                "offset": {
                  "gte": 1000,
                  "lte": 2000
                }
              }
            },
            {
              "match": {
                "source": "/var/log/apache2/access.log"
              }
            }
          ]
        }
      }
```

---

<div class="post-metadata">

**Author:** ![Dixon\_Almeida](https://avatars.discourse-cdn.com/v4/letter/d/ccd318/32.png) [@Dixon\_Almeida](https://discuss.elastic.co/u/Dixon_Almeida)\
**Post date:** [January 3, 2017, 5:47am UTC](https://discuss.elastic.co/t/elasticsearch-watcher-error-for-range-query/70347/3 "2017-01-03T05:47:31Z")

</div>

thank you nick for the help 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 31, 2017, 5:47am UTC](https://discuss.elastic.co/t/elasticsearch-watcher-error-for-range-query/70347/4 "2017-01-31T05:47:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.