Watcher last_checked

I have following code for the range of my watcher. However, I instead of the now I would like to use the last_checked value that you get when the watcher is executed. Is there any possibility to do that?

                    "range": {
                        "@timestamp": {
                          "gt": "now-1h",
                          "time_zone": "Europe/Vienna"
                        }
                      }

Hey,

can you explain where that last_checked variable is coming from? As you refer to as the last_checked value, you seem to use it already somewhere. Please add some context.

Thanks!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.