Watcher last_checked

I have following code for the range of my watcher. However, I instead of the now I would like to use the last_checked value that you get when the watcher is executed. Is there any possibility to do that?

                    "range": {
                        "@timestamp": {
                          "gt": "now-1h",
                          "time_zone": "Europe/Vienna"


can you explain where that last_checked variable is coming from? As you refer to as the last_checked value, you seem to use it already somewhere. Please add some context.


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.