# Watcher alert not functioning with Time range for no activity

**URL:** <https://discuss.elastic.co/t/watcher-alert-not-functioning-with-time-range-for-no-activity/202959>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [October 10, 2019, 7:05am UTC](https://discuss.elastic.co/t/watcher-alert-not-functioning-with-time-range-for-no-activity/202959 "2019-10-10T07:05:17Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![satishbaratam](https://avatars.discourse-cdn.com/v4/letter/s/e99b99/32.png) [@satishbaratam](https://discuss.elastic.co/u/satishbaratam)\
**Post date:** [October 10, 2019, 7:05am UTC](https://discuss.elastic.co/t/watcher-alert-not-functioning-with-time-range-for-no-activity/202959/1 "2019-10-10T07:05:17Z")

</div>

i am looking to create a watcher alert where i am alerted if there is no activity or logs for a service with in a time range . i have tried my bit but ending up with errors . here is the code for watcher alert

```
{
  "trigger": {
    "schedule": {
      "interval": "2m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "tibco*"
        ],
        "types": [],
        "body": {
          "size": 0,
          "query": {
            "filter": [
              {
                "range": {
                  "@timestamp": {
                    "gte": "now-30m",
                    "lt": "now"
                  }
                }
              },
              {
                "query_string": {
                  "default_field": "EnterpriseLogMessage.EnterpriseLoggingData.0.ServiceName",
                  "query": "DataAcess-ProcessCRMData"
                }
              }
            ]
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "lt": 1
      }
    }
  },
  "actions": {
    "notify-evanios-down": {
      "webhook": {
        "scheme": "http",
        "host": "10.3.52.14",
        "port": 5023,
        "method": "post",
        "path": "/eventlistener/createEvent",
        "params": {},
        "headers": {
          "Content-Type": "text/xml"
        },
        "body": "<?xml version=\"1.0\" encoding=\"UTF-8\"?> <events> <passkey>kibana</passkey> <event> <u_event_type>u_event</u_event_type> <u_severity>1</u_severity> <u_objectname>This is a test alert.</u_objectname> <u_application>Horizon</u_application> <u_description>This is a test alert.</u_description> <u_extrastr2>This is a test alert.</u_extrastr2> <u_message>This is a test alert. Escalate to satishkumar.baratam@asurion.com.</u_message> </event> </events>"
      }
    }
  }
}

```

Part of the output when simulating the watch, with the range as configured above is the following:  
"input": {  
"type": "search",  
"status": "failure",  
"error": {  
"root\_cause": [  
{  
"type": "parsing\_exception",  
"reason": "[filter] query malformed, no start\_object after query name",  
"line": 1,  
"col": 29  
}  
],  
"type": "parsing\_exception",  
"reason": "[filter] query malformed, no start\_object after query name",  
"line": 1,  
"col": 29  
},

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [October 11, 2019, 11:58am UTC](https://discuss.elastic.co/t/watcher-alert-not-functioning-with-time-range-for-no-activity/202959/2 "2019-10-11T11:58:33Z")

</div>

try your query with a regular `_search` operation and you will see it will fail as well. Instead of having a `filter` array, you need to wrap that one into a `bool` query, that contains your `filter` array.

Hope that helps.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 8, 2019, 11:58am UTC](https://discuss.elastic.co/t/watcher-alert-not-functioning-with-time-range-for-no-activity/202959/3 "2019-11-08T11:58:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.