Unable to forward watcher alert to index with all details

Elastic Security SIEM
1 
{
  "trigger": {
    "schedule": {
      "interval": "15m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "##selective index##"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "must": [
                {
                  "query_string": {
                    "query": """(lucene query)""",
                   }
                }
              ],
              "filter": {
                "range": {
                  "@timestamp": {
                    "gte": "now-5m/m"
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "not_eq": 0
      }
    }
  },
  "actions": {
    "index01": {
      "index": {
        "index": "##selected index for watcher alerts##"
      }
    }
  }
}

**though the watcher alert is firing not able to see in the index, **

2

Hi @aditi_salunke !

Just wanted to double check, is this related to the SIEM/Elastic Security app? If not, it may be best to tag with #stack-alerting .

Best,
Yara

3

Hi @yctercero ,

Thanks for the help .

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.