There might be another solution. It is a bit awkward, and won't work for all situations, but is worth mentioning.
The Chained Inputs feature of Watcher allows you to run more than one input. You could use the HTTP input to run a field stats request against the time-field of interest - this will show you the actual date range that currently exists in the searchable index, which would account for the time lag in getting the data processed, sent to ES, and the refresh period that @spinscale mentions.
Then your second input could be the search you're doing now, but instead of now-5s, you would do <ctx.field_stats_value_from_your_first_query>-5s. This would be considerably more robust.
If you wanted to account for bursts or backups in indexing, you could also consider extending the "lookback" period, and using throttling to ensure that you don't send too many notifications.