# Error saving watch \[1:234\] \[script\] unknown field \[query\]

**URL:** <https://discuss.elastic.co/t/error-saving-watch-1-234-script-unknown-field-query/296989>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [February 11, 2022, 2:53pm UTC](https://discuss.elastic.co/t/error-saving-watch-1-234-script-unknown-field-query/296989 "2022-02-11T14:53:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Abhi\_Abhishek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abhi_abhishek/32/101426_2.png) [@Abhi\_Abhishek](https://discuss.elastic.co/u/Abhi_Abhishek)\
**Post date:** [February 11, 2022, 2:53pm UTC](https://discuss.elastic.co/t/error-saving-watch-1-234-script-unknown-field-query/296989/1 "2022-02-11T14:53:43Z")

</div>

{  
"trigger": {  
"schedule": {  
"interval": "10s"  
}  
},  
"input": {  
"chain": {  
"inputs": [  
{  
"first": {  
"http": {  
"request": {  
"scheme": "https",  
"host": "**_",  
"port": ,  
"method": "get",  
"path": "llm\_full\_address/\_count",  
"body" : {  
"query": {  
"range": {  
"timestamp":{  
"gte": "now-1d/d",  
"lt": "now/d"  
}  
}  
}  
},  
"params": {},  
"headers": {},  
"auth": {  
"basic": {  
"username": "_",  
"password": "**"  
}  
}  
}  
}  
}  
},  
{  
"second": {  
"http": {  
"request": {  
"scheme": "https",  
"host": "_**",  
"port": ,  
"method": "get",  
"path": "llm\_keyahead\_address/\_count",  
"body" : {  
"query": {  
"range": {  
"timestamp":{  
"gte": "now-1d/d",  
"lt": "now/d"  
}  
}  
}  
},  
"params": {},  
"headers": {},  
"auth": {  
"basic": {  
"username": "",  
"password": ""  
}  
}  
}  
}  
}  
},  
{  
"third": {  
"http": {  
"request": {  
"scheme": "https",  
"host": "[seaselk-dev-elastic.corp.chartercom.com](http://seaselk-dev-elastic.corp.chartercom.com)",  
"port": 443,  
"method": "get",  
"params": {},  
"headers": {},  
"auth": {  
"basic": {  
"username": "",  
"password": ""  
}  
}  
}  
}  
}  
}  
]  
}  
},  
"condition": {  
"always": {}  
},  
"actions": {  
"send\_full\_address\_email": {  
"condition": {  
"compare": {  
"ctx.payload.first.count": {  
"eq": 0  
}  
}  
},  
"email": {  
"profile": "standard",  
"from": " **__**",  
"to": [  
" **_**"  
],  
"subject": "Data Unavailability in llm\_full\_address\_index",  
"body": {  
"text": "Index Count is {{ctx.payload.first.count}}, Please Validate the Index"  
}  
}  
},  
"send\_keyahead\_address\_email": {  
"condition": {  
"compare": {  
"ctx.payload.second.count": {  
"eq": 0  
}  
}  
},  
"email": {  
"profile": "standard",  
"from": "\*\*\*\*\*\*\*\*\*\*\*\*\*",  
"to": [  
" **_**"  
],  
"subject": "Data Unavailability in llm\_keyahead\_address\_index",  
"body": {  
"text": "Index Count is {{ctx.payload.second.count}}, Please Validate the Index."  
}  
}  
},  
"send\_status\_code\_email": {  
"condition": {  
"compare": {  
"ctx.payload.third.\_status\_code": {  
"not\_eq": 200  
}  
}  
},  
"email": {  
"profile": "standard",  
"from": " **__**",  
"to": [  
"**_\*"  
],  
"subject": "Status Code Alert",  
"body": {  
"text": "Status code is not 200, Please check credentials."  
}  
}  
}  
}  
}  
Actually I need trigger alert when the count is 0 in the 1day time range, But I am unable to create it.  
The problem is in  
"body" : {  
"query": {  
"range": {  
"timestamp":{  
"gte": "now-1d/d",  
"lt": "now/d"  
}  
}  
}  
}  
By adding this query its showing error, So please help me to solve this

---

<div class="post-metadata">

**Author:** ![jakelandis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jakelandis/32/36163_2.png) [@jakelandis](https://discuss.elastic.co/u/jakelandis)\
**Post date:** [February 11, 2022, 3:53pm UTC](https://discuss.elastic.co/t/error-saving-watch-1-234-script-unknown-field-query/296989/2 "2022-02-11T15:53:08Z")

</div>

The value of the `body` needs to be an escaped string. A JSON string as the value. [Watcher HTTP input | Elasticsearch Guide [8.0] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/input-http.html) has an example, and Kibana dev tools support triple quotes `"body": """{ ` to help with escaping. The script part of the error is likely due to the JSON parser interpreting the value as a mustache template.

---

<div class="post-metadata">

**Author:** ![Abhi\_Abhishek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abhi_abhishek/32/101426_2.png) [@Abhi\_Abhishek](https://discuss.elastic.co/u/Abhi_Abhishek)\
**Post date:** [February 11, 2022, 4:26pm UTC](https://discuss.elastic.co/t/error-saving-watch-1-234-script-unknown-field-query/296989/3 "2022-02-11T16:26:32Z")

</div>

Thank you, This solved my problem...

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 11, 2022, 4:26pm UTC](https://discuss.elastic.co/t/error-saving-watch-1-234-script-unknown-field-query/296989/4 "2022-03-11T16:26:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.