NTP server time sync issue - how to write alerts (Query DSL )

[stephenb (Stephen Brown)]

Closing as duplicate of:

[Urgent] which 2 fields in Elastic Search can be made as time unsync comparsion?

{ "query": { "query_string": { "query": "("NTP server status changes to unreachable" OR "Global time setting changed by NTP") AND devname:(ABC)", "default_field": "logdesc" } } }