# Query DSL alert configuration
**URL:** https://discuss.elastic.co/t/query-dsl-alert-configuration/385538
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [March 20, 2026, 3:00am UTC](https://discuss.elastic.co/t/query-dsl-alert-configuration/385538 "2026-03-20T03:00:04Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)
#### Post date: [March 20, 2026, 3:00am UTC](https://discuss.elastic.co/t/query-dsl-alert-configuration/385538/1 "2026-03-20T03:00:04Z")
I am trying to use the Elasticsearch Query DSL to create an alert
The query consist of LIMIT 100 but the actual output is actually less than 10.
When I did run the test query . Query matched 852597 documents in the last 5m.
What am I doing wrong or missing out?
###Settings below is default
Set the group, threshold, and time window
when count()
over all documents
Is above 10
for the last 5 minutes
Set the number of documents to send
Size 10
---
### Author:  [@Tortoise](https://discuss.elastic.co/u/Tortoise)
#### Post date: [March 21, 2026, 5:18am UTC](https://discuss.elastic.co/t/query-dsl-alert-configuration/385538/2 "2026-03-21T05:18:41Z")
Hello @Whoami1980
As you are using query DSL :
Query matched 1150 documents in last 5d
Size → Controls how many docs are RETURNED/SENT
Now if you are saying that as per your index data your query has only 5-10 records matching your query but in Query DSL more count is shown than the issue is with the query which is executed & that needs to be reviewed.
Thanks!!
---
### Author:  [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)
#### Post date: [March 23, 2026, 9:12am UTC](https://discuss.elastic.co/t/query-dsl-alert-configuration/385538/3 "2026-03-23T09:12:50Z")
This is the query i am using . i am not sure what else is wrong
```auto
POST /_query?format=txt
{
"query": """
FROM ABCD*:metrics-logstash*
| WHERE @timestamp > NOW() - 60 minutes
AND (logstash.pipeline.total.queues.current_size.bytes) IS NOT NULL
AND (logstash.pipeline.total.queues.max_size.bytes) > 0
| STATS
max_workers = MAX(logstash.pipeline.info.workers),
max_batch = MAX(logstash.pipeline.info.batch_size),
max_pq_bytes = MAX(logstash.pipeline.total.queues.current_size.bytes),
max_queues_size = MAX(logstash.pipeline.total.queues.max_size.bytes)
BY host.hostname, logstash.pipeline.name
| EVAL pq_percent = ROUND((TO_DOUBLE(max_pq_bytes) / max_queues_size) * 100, 2)
| WHERE pq_percent > 40
| SORT pq_percent DESC
| LIMIT 10
"""
```
---
### Author:  [@Tortoise](https://discuss.elastic.co/u/Tortoise)
#### Post date: [March 23, 2026, 12:44pm UTC](https://discuss.elastic.co/t/query-dsl-alert-configuration/385538/4 "2026-03-23T12:44:14Z")
Hello @Whoami1980
If you want to check for last 5 minutes than it should be `minus 5 minutes :`
> [@Whoami1980](#):
>
> `WHERE @timestamp > NOW() - 60 minutes`
Thanks!!
---
### Author:  [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)
#### Post date: [March 26, 2026, 4:04am UTC](https://discuss.elastic.co/t/query-dsl-alert-configuration/385538/5 "2026-03-26T04:04:44Z")
@Tortoise
Our query DSL is "FROM _:metrics-logstash_"
However when creating the alert rule it needs to select specific indices.
Is it possible to use wildcard?
Also when we specific some indices.
There isnt any time field to select. Any advice