At first blush - your setting of range of @timestamp to be "gte": "now-3m" looks correct. Are you sure, however, that there are actually some 404 errors your logs in the last 3 minutes?
Sorry for the misunderstanding - I thought originally you were looking for information on the search input for a Watch. If you're looking for information on options for the range query, you can find it here - it is a core feature of the elasticsearch query DSL, not just a feature of a watch.
Taking a harder look at your setup, you should modify your query clause to look like this:
Another thing to double check is that your time field in your index truly is @timestamp instead of other possibilities (like just plain timestamp)
Finally, to take any possible setup issues related to the email notification out of the picture, you can add the following logging action in addition to the email:
"actions": {
"log": {
"logging": {
"level": "info",
"text": "Watcher Notification from {{ctx.payload.hits.hits.0._source.beat.name}} - Found {{ctx.payload.hits.total}} 404 errors in the logs"
}
},
"send_email": {
"throttle_period_in_millis": 180000,
"email": {
"profile": "standard",
"from": "shengyongp@oupeng.com",
"to": [
"PeiShengyong shengyongp@oupeng.com",
"DuanWei weiduan@oupeng.com"
],
"subject": "Watcher Notification from {{ctx.payload.hits.hits.0._source.beat.name}}",
"body": {
"text": "Found {{ctx.payload.hits.total}} 404 errors in the logs"
}
}
}
},
So that the text of the watch results simply show up in the elasticsearch.log file.
[2017-07-24T11:27:03,007][ERROR][o.e.x.w.i.s.ExecutableSimpleInput] [uy-s-169] failed to execute [search] input for watch [error_fzf], reason [[range] malformed query, expected [END_OBJECT] but found [FIELD_NAME]]
If you haven't changed your query clause to what I recommend, you will get this error because there is a syntax problem in your query clause. You are not properly making an array of clauses in the filter section. You have to look close at the matching {} brackets to see.
Please modify it to the following and you'll be fine:
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.