Watcher, difference between setting the time range using contex and without using context

Hi, What is the difference in setting an alert with watcher using context , like this:

                "range": {
                  "@timestamp": {
                    "gte": "{{ctx.trigger.scheduled_time}}||-30m",
                    "lte": "{{ctx.trigger.scheduled_time}}"
                  }
                }

and not using context, like this:

                 "range": {
                   "@timestamp": {
                     "gte": "now-30m",
                     "lt": "now"
                   }
                 }

Is one option better than the other? one option has his benefits?

Thanks!

Hey,

so watches are not guaranteed to run at the exact same time when they are scheduled (imagine a node outage happening at that time or a garbage collection delaying the watch execution).

In that case now refers to the point in time when the watch is running, where as the trigger scheduled time refers to the point in time when the watch was supposed to run.

If you run a watch every few minutes this probably does not matter, but think might be different with a cron job for example.

Hope that helps!

--Alex

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.