We have a use case where the watcher should skip sifting through all the documents that it has already used for matching the watcher query. The next time the watcher runs, only new documents should be used for matching.
We currently have a sliding window of timestamp where it selects only messages generated in the last X mins.
But, there could be case where, some messages have older timestamps and were delivered to elastic after a delay.
So, what we want to do is, update / tag all documents that the watcher searched through and then have a condition in the watcher to not pick these tagged documents. Is this possible in watcher today?