# Query that parses and works fine in ES, fails to parse/work in Watcher

**URL:** https://discuss.elastic.co/t/query-that-parses-and-works-fine-in-es-fails-to-parse-work-in-watcher/172762
**Category:** Kibana
**Tags:** elastic-stack-alerting
**Created:** [March 18, 2019, 11:48am UTC](https://discuss.elastic.co/t/query-that-parses-and-works-fine-in-es-fails-to-parse-work-in-watcher/172762 "2019-03-18T11:48:14Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![mje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mje/32/42234_2.png) [@mje](https://discuss.elastic.co/u/mje)
#### Post date: [March 18, 2019, 11:48am UTC](https://discuss.elastic.co/t/query-that-parses-and-works-fine-in-es-fails-to-parse-work-in-watcher/172762/1 "2019-03-18T11:48:14Z")

</div>

Hi all,

I've ventured out to depths where I cannot reach the bottom.

I have a search that finds events from a standard winlogbeat index, where I look at events from a set of specific users, with the 'should' bool - because I'm looking for any one of them. That is bool-must'ed together with a time range, like this;

```
{
  "query": {
    "bool": {
      "must": {
        "bool": {
          "should": [
            {
              "match_phrase": {
                "event_data.TargetUserName": {
                  "query": "user-a"
                }
              }
            },
            {
              "match_phrase": {
                "event_data.TargetUserName": {
                  "query": "user-b"
                }
              }
            },
            {
              "match_phrase": {
                "event_data.TargetUserName": {
                  "query": "user-c"
                }
              }
            }
          ]
        }
      },
      "must": {
        "range": {
          "@timestamp": {
            "gte": "now-30m"
          }
        }
      }

    }
  }
}

```

And it works as I'd like it to, I can validate the results, and I'm very happy about it. 🙂

However, having created some watchers where I replace my 'query' section of the standard watcher template, I've not been able to get above to work, as it doesn't parse in the Watcher JSON editor; the second 'must' keyword gives me a:

> Duplicate key "must"

![duplicate_key_must_watcher](https://us1.discourse-cdn.com/elastic/original/3X/8/8/8826f15c683d15f9e6708630000cdfd50d97a2a4.png)

Which puzzles me, as the query works when run from ie. the developer console; but the same query as search input to watcher doesn't work.

So either I'm doing it very wrong entirely (which is my guess), which happens to work outside Watcher, or (less likely) something is off with watcher.

🙂

I hope someone can point out what I'm doing wrong.

The full content of my watcher editor (Kibana/Elasticsearch 5.6.14);

```
{
  "trigger": {
    "schedule": {
      "interval": "30m"
    }
  },
  "input": {
    "search": {
      "request": {
        "body": {
          "size": 0,
          "query": {
    "bool": {
      "must": {
        "bool": {
          "should": [
            {
              "match_phrase": {
                "event_data.TargetUserName": {
                  "query": "user-a"
                }
              }
            },
            {
              "match_phrase": {
                "event_data.TargetUserName": {
                  "query": "user-b"
                }
              }
            },
            {
              "match_phrase": {
                "event_data.TargetUserName": {
                  "query": "user-c"
                }
              }
            }
          ]
        }
      },
      "must": {
        "range": {
          "@timestamp": {
            "gte": "now-30m"
          }
        }
      }

    }
  }
        },
        "indices": [
          "winlogbeat-*"
        ]
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gte": 1
      }
    }
  },
  "actions": {
    "my-logging-action": {
      "logging": {
        "text": "There are {{ctx.payload.hits.total}} documents in your index. Threshold is 10."
      }
    }
  }
}

```

---

<div class="post-metadata">

### Author: ![azasypkin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/azasypkin/32/42216_2.png) [@azasypkin](https://discuss.elastic.co/u/azasypkin)
#### Post date: [March 18, 2019, 12:04pm UTC](https://discuss.elastic.co/t/query-that-parses-and-works-fine-in-es-fails-to-parse-work-in-watcher/172762/2 "2019-03-18T12:04:51Z")

</div>

Hi @mje,

I guess the proper syntax would be `"must" : [{...1st...}, {...2nd....}]`, see [2 'musts' in 1 bool illegal?](https://discuss.elastic.co/t/2-musts-in-1-bool-illegal/103846/2?u=azasypkin) and [Elasticsearch bool query formation with multiple must clause](https://discuss.elastic.co/t/elasticsearch-bool-query-formation-with-multiple-must-clause/97509/2).

Best,  
Oleg

---

<div class="post-metadata">

### Author: ![mje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mje/32/42234_2.png) [@mje](https://discuss.elastic.co/u/mje)
#### Post date: [March 18, 2019, 12:18pm UTC](https://discuss.elastic.co/t/query-that-parses-and-works-fine-in-es-fails-to-parse-work-in-watcher/172762/3 "2019-03-18T12:18:08Z")

</div>

That did it, thank you so much. 😃

However, I'm still surprised that it works in std. dev console/curl. 😐

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 15, 2019, 12:18pm UTC](https://discuss.elastic.co/t/query-that-parses-and-works-fine-in-es-fails-to-parse-work-in-watcher/172762/4 "2019-04-15T12:18:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.