# Use time filter and field filter in watcher
**URL:** https://discuss.elastic.co/t/use-time-filter-and-field-filter-in-watcher/207704
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [November 13, 2019, 12:36pm UTC](https://discuss.elastic.co/t/use-time-filter-and-field-filter-in-watcher/207704 "2019-11-13T12:36:51Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@rvenne](https://discuss.elastic.co/u/rvenne)
#### Post date: [November 13, 2019, 12:36pm UTC](https://discuss.elastic.co/t/use-time-filter-and-field-filter-in-watcher/207704/1 "2019-11-13T12:36:51Z")
I want to run a watcher that checks if an error with a specific message is occuring within a specific time range. This is the current custom watch JSON that I made:
> {
> "trigger": {
> "schedule": {
> "interval": "1m"
> }
> },
> "input": {
> "search": {
> "request": {
> "search\_type": "query\_then\_fetch",
> "indices": [
> "iburgerzaken-blueriq-\*"
> ],
> "rest\_total\_hits\_as\_int": true,
> "body": {
> "query": {
> "bool": {
> "filter": [
> {
> "range": {
> "@timestamp": {
> "from": "now-1m",
> "to": "now"
> }
> }
> }
> ]
> },
> "match": {
> "message": {
> "query": "Invalid date format pattern 'DD-MM-YYYY'"
> }
> }
> }
> }
> }
> }
> },
> "condition": {
> "compare": {
> "ctx.payload.hits.total.value": {
> "gt": 0
> }
> }
> },
> "actions": {
> "email\_administrator": {
> "email": {
> "profile": "standard",
> "attachments": {
> "attached\_data": {
> "data": {
> "format": "json"
> }
> }
> },
> "priority": "high",
> "to": [
> "[email@email.com](mailto:email@email.com)"
> ],
> "subject": "Error: Invalid date format pattern 'DD-MM-YYYY' has occured {{ctx.payload.hits.total.value}} times",
> "body": {
> "text": "Alert for error: Invalid date format pattern 'DD-MM-YYYY'. See attached data for in depth information"
> }
> }
> }
> }
> }
But I'm getting the following error:
> "error": {
> "root\_cause": [
> {
> "type": "parsing\_exception",
> "reason": "[bool] malformed query, expected [END\_OBJECT] but found [FIELD\_NAME]",
> "line": 1,
> "col": 85
> }
> ],
> "type": "parsing\_exception",
> "reason": "[bool] malformed query, expected [END\_OBJECT] but found [FIELD\_NAME]",
> "line": 1,
> "col": 85
> }
Can someone please help me with this?
---
### Author:  [@rvenne](https://discuss.elastic.co/u/rvenne)
#### Post date: [November 18, 2019, 3:25pm UTC](https://discuss.elastic.co/t/use-time-filter-and-field-filter-in-watcher/207704/2 "2019-11-18T15:25:05Z")
Sorry, the JSON is not really readable.
Here the watch that I made:
[https://pastebin.com/UMTcXAUM](https://pastebin.com/UMTcXAUM)
And here the error:
[https://pastebin.com/3iaffBVz](https://pastebin.com/3iaffBVz)
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [November 20, 2019, 3:50pm UTC](https://discuss.elastic.co/t/use-time-filter-and-field-filter-in-watcher/207704/3 "2019-11-20T15:50:17Z")
Hey,
you need to wrap the `match` query within the `bool` query like this
```auto
"bool" :{
"must" : [
{ "match" : ... }
],
"filter" : [
{ "range" : {} }
]
}
```
---
### Author:  [@rvenne](https://discuss.elastic.co/u/rvenne)
#### Post date: [November 28, 2019, 12:52pm UTC](https://discuss.elastic.co/t/use-time-filter-and-field-filter-in-watcher/207704/4 "2019-11-28T12:52:12Z")
Thank you, this worked for me!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 26, 2019, 12:52pm UTC](https://discuss.elastic.co/t/use-time-filter-and-field-filter-in-watcher/207704/5 "2019-12-26T12:52:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.