# How to apply filter in a watcher query? "\[boosting\] query does not support \[filter\]"

**URL:** <https://discuss.elastic.co/t/how-to-apply-filter-in-a-watcher-query-boosting-query-does-not-support-filter/201740>\
**Category:** Elasticsearch\
**Created:** [October 1, 2019, 7:20am UTC](https://discuss.elastic.co/t/how-to-apply-filter-in-a-watcher-query-boosting-query-does-not-support-filter/201740 "2019-10-01T07:20:12Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![sonal\_singh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sonal_singh/32/54146_2.png) [@sonal\_singh](https://discuss.elastic.co/u/sonal_singh)\
**Post date:** [October 1, 2019, 7:20am UTC](https://discuss.elastic.co/t/how-to-apply-filter-in-a-watcher-query-boosting-query-does-not-support-filter/201740/1 "2019-10-01T07:20:12Z")

</div>

Hi Gurus,

Here is a scenario:  
I have set up an alert based upon a keyword " Spamhaus", to check logs every hour.  
It is working fine.  
BUT,  
I want exclude any logs if Keywords comes in with "(Spamhaus/Invaluement/ReturnPath)" in this format.

Based upon my regex i am using "_pamhaus_" to handle both capital "S" and small "s" in "Spamhaus keyword"

I am trying to look for a filter to further discard any results with keyword "(Spamhaus/Invaluement/ReturnPath)".

How to make this possible?

Here is my watcher code:  
"body": {  
"query": {  
"boosting": {  
"positive": {  
"query\_string": {  
"query": "textFromISP: _pamhaus_"  
}  
},  
"negative": {  
"query\_string": {  
"query": "textFromISP: _/Invaluement_"  
}  
},  
"negative\_boost": 0.5,  
"filter": {  
"range": {  
"@timestamp": {  
"from": "now-6h",  
"to": "now"  
}

Please help.

Here is the output:  
"result": {  
"execution\_time": "2019-10-01T12:19:00.066Z",  
"execution\_duration": 0,  
"input": {  
"type": "search",  
"status": "failure",  
"error": {  
"root\_cause": [  
{  
"type": "parsing\_exception",  
"reason": "[boosting] query does not support [filter]",  
"line": 1,  
"col": 177  
}  
],  
"type": "parsing\_exception",  
"reason": "[boosting] query does not support [filter]",  
"line": 1,  
"col": 177  
},

Thanks,  
Sonal

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 29, 2019, 7:20am UTC](https://discuss.elastic.co/t/how-to-apply-filter-in-a-watcher-query-boosting-query-does-not-support-filter/201740/2 "2019-10-29T07:20:21Z")

</div>

Closed on October 29, 2019, 7:20am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.