# How to check only the documents with in the interval?

**URL:** https://discuss.elastic.co/t/how-to-check-only-the-documents-with-in-the-interval/60599
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [September 15, 2016, 11:13am UTC](https://discuss.elastic.co/t/how-to-check-only-the-documents-with-in-the-interval/60599 "2016-09-15T11:13:55Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![YuWatanabe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuwatanabe/32/13259_2.png) [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)
#### Post date: [September 15, 2016, 11:13am UTC](https://discuss.elastic.co/t/how-to-check-only-the-documents-with-in-the-interval/60599/1 "2016-09-15T11:13:55Z")

</div>

I want to check only the documents which was indexed within **the interval of watcher execution** but **result.input.payload.hits.total** is returning all the matched documents in the index matching the query.

My watcher definition is below.

```
PUT _xpack/watcher/watch/cpu_monitoring
{
  "metadata" : { 
    "color" : "red"
  },
  "trigger" : { 
    "schedule" : {
      "interval" : "1m"
    }
  },
  "input" : { 
    "search" : {
      "request" : {
        "indices" : "metricbeat-*",
        "body" : {
          "query" : {
            "bool" : {
              "must" : [
                {"match" : { "metricset.name" : "cpu" }},
                {"range" : { "system.cpu.idle.pct" : {"lte" : "0.97" } } }
              ]
            }
          }
        }
      }
    }
  },
  "condition" : { 
    "compare" : { "ctx.payload.hits.total" : { "gt" : 0 }}
  },
  "actions" : { 
    "email_administrator" : {
      "email" : {
        "to" : "root@localhost.localdomain",
        "subject" : "Encountered {{ctx.payload.hits.total}} errors",
        "body" : "Too many error in the system, see attached data",
        "attachments" : {
          "attached_data" : {
            "data" : {
              "format" : "json"
            }
          }
        },
        "priority" : "high"
      }
    }
  }
}

```

![](https://us1.discourse-cdn.com/elastic/original/2X/c/cf485b60f2299c60b741168e9d1329afab598a93.PNG)

I appreciate if someone can help me how to fix my query.

---

<div class="post-metadata">

### Author: ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [September 15, 2016, 12:58pm UTC](https://discuss.elastic.co/t/how-to-check-only-the-documents-with-in-the-interval/60599/2 "2016-09-15T12:58:16Z")

</div>

Hey,

you need to add another filter to your `must` query that filters for time. Also you should use date math for correct index filtering.

See [https://www.elastic.co/guide/en/elasticsearch/reference/2.4/common-options.html#date-math](https://www.elastic.co/guide/en/elasticsearch/reference/2.4/common-options.html#date-math)  
and [https://www.elastic.co/guide/en/watcher/2.4/transform.html#transform-search-template](https://www.elastic.co/guide/en/watcher/2.4/transform.html#transform-search-template) for an example how to filter by date.

--Alex

---

<div class="post-metadata">

### Author: ![YuWatanabe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuwatanabe/32/13259_2.png) [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)
#### Post date: [September 15, 2016, 9:40pm UTC](https://discuss.elastic.co/t/how-to-check-only-the-documents-with-in-the-interval/60599/3 "2016-09-15T21:40:38Z")

</div>

Thanks @spinscale

I just figured out it too.

```
  "input" : { 
    "search" : {
      "request" : {
        "indices" : "metricbeat-*",
        "body" : {
          "query" : {
            "bool" : {
              "must" : [
                {"match" : { "metricset.name" : "cpu" }},
                {"range" : { "system.cpu.idle.pct" : {"lte" : "0.97" } } },
                {"range" : { "@timestamp" : {"gte" : "now-1m", "lte" : "now" } } }
              ]
            }
          }
        }
      }
    }
  },
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:42pm UTC](https://discuss.elastic.co/t/how-to-check-only-the-documents-with-in-the-interval/60599/4 "2017-07-06T13:42:53Z")

</div>