# Watcher + PDF in email with filter last 24hours

**URL:** https://discuss.elastic.co/t/watcher-pdf-in-email-with-filter-last-24hours/375792
**Category:** Elasticsearch
**Created:** [March 12, 2025, 4:16pm UTC](https://discuss.elastic.co/t/watcher-pdf-in-email-with-filter-last-24hours/375792 "2025-03-12T16:16:47Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![Real\_Talk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/real_talk/32/140504_2.png) [@Real\_Talk](https://discuss.elastic.co/u/Real_Talk)
#### Post date: [March 12, 2025, 4:16pm UTC](https://discuss.elastic.co/t/watcher-pdf-in-email-with-filter-last-24hours/375792/1 "2025-03-12T16:16:47Z")

</div>

Hello,

Sorry, I am new to the ELK universe.

I created an observer with a filter, and I configured it to add a PDF in a notification email. My filter is set to the last 24 hours (at the current time), I would like to modify the URL generated via "Copy POST URL" to have a fromDate to Date for the last 24 hours each time the filter matches instead of the current filter time, but I can't replace that part in the code string, is it possible?

Example "resolvedDateRange%3A%28fromDate%3A%272025-03-10T14%3A04%3A16.324Z%27%2CtoDate%3A%272025-03-11T14%3A04%3A16.324Z%27%29%2C"

to something like mentioned in the documentation [Automatically generate reports | Kibana Guide [8.13] | Elastic](https://www.elastic.co/guide/en/kibana/8.13/automating-report-generation.html#create-a-post-url:)

resolvedDate(range:(%27@timestamp%27:(gte:now-24h%2Fd,lte:now%2Fd)))

Could you please help me?

Thank you in advance.