Hello guys, I need to set a Watcher to look for results of a certain query. I need the results from the last 5 minutes (generally, it returns all the results from the index if I don't specify a filter). This is the Watcher code:
{
"trigger" : {
"schedule" : {
"interval" : "5m"
}
},
"input" : {
"search" : {
"request" : {
"indices" : [ "<logstash-{now/d}>"],
"types" : [ "vectra" ],
"body" : {
"sort" : {
"@timestamp" : {"order" : "desc"}
},
"query" : {
"bool" : {
"must" : [
{ "match" : { "leverage_type" : "Sweeper" }}
],
"filter" : [
{ "range" : { "@timestamp" : { "gte" : "<{now-5m}>"}}}
]
}
}
}
}
}
},
"condition" : {
"compare" : {
"ctx.payload.hits.total" : {
"gt" : 0
}
}
},
"actions" : {
"notify-slack" : {
"throttle_period" : "5m",
"slack" : {
"account" : "testing",
"message" : {
"to" : [ "@tester" ],
"text" : "{{ctx.payload.hits.total}} Vectra entries found"
}
}
}
}
}
And I'm receiving the following error:
SearchPhaseExecutionException[all shards failed]; nested: ElasticsearchParseException[failed to parse date field [<{now-5m}>] with format [strict_date_optional_time||epoch_millis]]; nested: IllegalArgumentException[Parse failure at index [0] of [<{now-5m}>]];
How can I do a filter for the results that are newer than a certain date and time?