Watcher for string value - Returns 'met : false'

[EricJohnson]

I updated my question.

Field "level" only returns Null in Watcher

Greetings I'm trying to write a watcher to look at a string field called "level." If level is LOG, I need to alert on it. The watcher is running but the value appears to always be null. I've tried various things but nothing has worked so far. The record looks like this: { "_index": "applog-test-001", "_type": "_doc", ... "level": "LOG", "message": "Database connected...", "host": { "hostname": "applog_host", "os": { "kernel": "2.6.32-754.24.3.el6.x86_64", "codename": "Santiago", "name": "R…