# Using "lte" : "Now" in Watcher Date Range giving Unusual behaviour

**URL:** <https://discuss.elastic.co/t/using-lte-now-in-watcher-date-range-giving-unusual-behaviour/214865>\
**Category:** Kibana\
**Created:** [January 13, 2020, 3:58pm UTC](https://discuss.elastic.co/t/using-lte-now-in-watcher-date-range-giving-unusual-behaviour/214865 "2020-01-13T15:58:20Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Will\_Monkeys](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/will_monkeys/32/60724_2.png) [@Will\_Monkeys](https://discuss.elastic.co/u/Will_Monkeys)\
**Post date:** [January 13, 2020, 3:58pm UTC](https://discuss.elastic.co/t/using-lte-now-in-watcher-date-range-giving-unusual-behaviour/214865/1 "2020-01-13T15:58:20Z")

</div>

Hey!

I'm trying to set up a Watcher that fires any time a document enter a given index, with the property Command containing the phrase "New Workset".

I got a query from the Discover tab \> Inspect, then coped and pasted this into an advanced Watcher JSON like this (notice the fixed gte/lte date range):

```auto
{
  "trigger": {
    "schedule": {
      "interval": "5m"
    }
  },
  "input": {
    "search": {
      "request": {
        "body": {
          "size": 0,
  "query": {
    "bool": {
      "must": [],
      "filter": [
        {
          "bool": {
            "should": [
              {
                "match_phrase": {
                  "Command": "New Workset"
                }
              }
            ],
            "minimum_should_match": 1
          }
        },
        {
          "range": {
            "@timestamp": {
              "format": "strict_date_optional_time",
              "gte": "2020-01-13T13:40:34.449Z",
              "lte": "2020-01-13T16:40:34.449Z"
            }
          }
        }
      ],
      "should": [],
      "must_not": []
    }}

        },
        "indices": [
          "*"
        ]
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gte": 1
      }
    }
  },
  "actions": {
    "my-logging-action": {
      "logging": {
        "text": "There are {{ctx.payload.hits.total}} documents in your index. Threshold is 10."
      }
    }
  }
}

```

I simulated the Watcher and got 5 documents, as expected, and the Watcher fired.

Then, I wanted to change the date ranges to make them dynamic using the "now-1h" syntax. I want the Watcher to trigger if there is at least one document added to the index that meets the condition.

I thought this would be easy, but when I did it, I didn't get the results expected.

When the date is set to:

```auto
        {
          "range": {
            "@timestamp": {
              "format": "strict_date_optional_time",
              "gte": "now-2h",
              "lte": "now"
            }
          }
        }

```

I get the following, which is actually wrong (should be 5, and _yes_ all these documents are definitely within the last 2 hours):

```auto
"condition": {
      "type": "compare",
      "status": "success",
      "met": true,
      "compare": {
        "resolved_values": {
          **"ctx.payload.hits.total": 3**
        }
      }
    },

```

I think I've narrowed it down to the lte:"Now" line - not functioning properly, because when I try this Date Range, I get the correct ctx.payload.hits.total of 5

```auto
          "range": {
            "@timestamp": {
              "format": "strict_date_optional_time",
              "gte": "now-2h",
              "lte": "2020-01-13T16:40:34.449Z"
            }
          }
        }

```

Any ideas why this might be happening when I use lte:"Now"?

Thanks

---

<div class="post-metadata">

**Author:** ![Will\_Monkeys](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/will_monkeys/32/60724_2.png) [@Will\_Monkeys](https://discuss.elastic.co/u/Will_Monkeys)\
**Post date:** [January 13, 2020, 4:06pm UTC](https://discuss.elastic.co/t/using-lte-now-in-watcher-date-range-giving-unusual-behaviour/214865/2 "2020-01-13T16:06:42Z")

</div>

I also tried changing the lte to lt, still the same error.

---

<div class="post-metadata">

**Author:** ![Will\_Monkeys](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/will_monkeys/32/60724_2.png) [@Will\_Monkeys](https://discuss.elastic.co/u/Will_Monkeys)\
**Post date:** [January 23, 2020, 3:05pm UTC](https://discuss.elastic.co/t/using-lte-now-in-watcher-date-range-giving-unusual-behaviour/214865/3 "2020-01-23T15:05:35Z")

</div>

Anyone? 😳

---

<div class="post-metadata">

**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\
**Post date:** [January 28, 2020, 4:36pm UTC](https://discuss.elastic.co/t/using-lte-now-in-watcher-date-range-giving-unusual-behaviour/214865/4 "2020-01-28T16:36:35Z")

</div>

Maybe it's something related to the timezone of the Kibana server and the timezone of the data when it's ingested. Is there a difference that could explain this?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 25, 2020, 4:47pm UTC](https://discuss.elastic.co/t/using-lte-now-in-watcher-date-range-giving-unusual-behaviour/214865/5 "2020-02-25T16:47:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.