# Watcher issues using ranger query for @timestamp with slow processing speed

**URL:** <https://discuss.elastic.co/t/watcher-issues-using-ranger-query-for-timestamp-with-slow-processing-speed/238425>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [June 24, 2020, 9:48am UTC](https://discuss.elastic.co/t/watcher-issues-using-ranger-query-for-timestamp-with-slow-processing-speed/238425 "2020-06-24T09:48:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jasonespo](https://avatars.discourse-cdn.com/v4/letter/j/898d66/32.png) [@Jasonespo](https://discuss.elastic.co/u/Jasonespo)\
**Post date:** [June 24, 2020, 9:48am UTC](https://discuss.elastic.co/t/watcher-issues-using-ranger-query-for-timestamp-with-slow-processing-speed/238425/1 "2020-06-24T09:48:46Z")

</div>

Hi guys,

So I was wondering today if there would be a better way to do use watchers. We use the below to search the past 2minutes worth of data for anything that matches our query.

```
   "filter": [
            {
              "range": {
                "@timestamp": {
                  "gte": "now-{{ctx.metadata.window_period}}"

```

It works as I expect however it poses issues if we have slow processing speed.

When considering the below screenshot, data is being "back filled" and will never be queried by our watchers.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/5/9510f79e9fa822996fc19323c1ed0c373457247d.png)

Is there a way that we would be able to use our range query to query something like the last log time -2minutes?

Thanks in advance

---

<div class="post-metadata">

**Author:** ![Jasonespo](https://avatars.discourse-cdn.com/v4/letter/j/898d66/32.png) [@Jasonespo](https://discuss.elastic.co/u/Jasonespo)\
**Post date:** [June 29, 2020, 2:06pm UTC](https://discuss.elastic.co/t/watcher-issues-using-ranger-query-for-timestamp-with-slow-processing-speed/238425/2 "2020-06-29T14:06:25Z")

</div>

bump

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 27, 2020, 2:07pm UTC](https://discuss.elastic.co/t/watcher-issues-using-ranger-query-for-timestamp-with-slow-processing-speed/238425/3 "2020-07-27T14:07:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.