Hi there, another question from another ES noob. So I've managed to set up a Watch to alert on any successful logins, however, when the Watch executes, it appears to be querying data from the day before, even when I've included datemath in the "indices" section of "input" within the Watch JSON scrip…

Watcher querying data within indices from the day before

system (system) Closed May 1, 2020, 2:24pm 4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Watcher false alerts (query wrong? ) Elasticsearch elastic-stack-alerting	5	1339	September 5, 2017
Can I limit a watch to today and yesterday using "indices"? Elasticsearch elastic-stack-alerting	2	1490	July 6, 2017
Elastic Search - Advanced Watcher Script Elasticsearch elastic-stack-alerting	2	535	February 10, 2020
Watching Logstash indexes Elasticsearch elastic-stack-alerting	2	732	July 6, 2017
Watcher creation help Elasticsearch elastic-stack-alerting	1	208	October 25, 2022