Hi, I use this code, when I remove the line: "filter": { "range" : { "@timestamp": { "from" : "now-5m"}}}: it works but I get a lot of hits. When I add this line I get the message "execution not needed", why is that?
{
"trigger" : {
"schedule" : {
"interval" : "1m" }
},
"input" : {
"search" : {
"request" : {
"indices" : [ "<logstash-{now/d}>" ],
"body" : {
"query" : {
"bool": {
"must": { "match" : { "message": "BGP" }},
"filter": { "range" : { "@timestamp": { "from" : "now-5m"}}}
}
}
}
}
}
},
"condition" : {
"compare" : { "ctx.payload.hits.total" : { "gt" : 0 }}
},
"actions" : {
"send_email" : {
"throttle_period" : "15m",
"email" : {
"account" : "work",
"to" : "xxxxx@xxx.xl",
"subject" : "[KIBANA] {{ctx.payload.hits.total}} BGP flaps",
"body" : "BGP flaps",
"attach_data" : true
}
}
}
}