Watcher issues using ranger query for @timestamp with slow processing speed

[Jasonespo (JasonE)]

Hi guys,

So I was wondering today if there would be a better way to do use watchers. We use the below to search the past 2minutes worth of data for anything that matches our query.

   "filter": [
            {
              "range": {
                "@timestamp": {
                  "gte": "now-{{ctx.metadata.window_period}}"

It works as I expect however it poses issues if we have slow processing speed.

When considering the below screenshot, data is being "back filled" and will never be queried by our watchers.

Is there a way that we would be able to use our range query to query something like the last log time -2minutes?

Thanks in advance

[Jasonespo (JasonE)]

bump