# Watcher search for feild value in last 1mins

**URL:** <https://discuss.elastic.co/t/watcher-search-for-feild-value-in-last-1mins/50188>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [May 17, 2016, 6:54am UTC](https://discuss.elastic.co/t/watcher-search-for-feild-value-in-last-1mins/50188 "2016-05-17T06:54:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![briangildea](https://avatars.discourse-cdn.com/v4/letter/b/e9bcb4/32.png) [@briangildea](https://discuss.elastic.co/u/briangildea)\
**Post date:** [May 17, 2016, 6:54am UTC](https://discuss.elastic.co/t/watcher-search-for-feild-value-in-last-1mins/50188/1 "2016-05-17T06:54:00Z")

</div>

I'm having issues getting watcher to work while querying  
a time range filter of the previous 5 minutes.

PUT /\_watcher/watch/log\_error\_watch  
{

"trigger" : { "schedule" : { "interval" :  
"60s" } },  
"input"  
: {

"search" : {

"request" : {

"indices" : ["APPINDEX-\*"],

"body" : {

"query" : {

"match" : { "ENCODE": "14310" }},  
"filter" : {"range" :  
{"@timestamp" : {"gte" : "now-5m"}}}  
}  
}  
}  
}  
,  
"condition" : {  
"compare" : { "ctx.payload.hits.total" : {  
"gt" : 5 }}  
},  
"actions" : {  
"send\_email"  
: {

"email" : {

"to" : "brian.gildea@DOMAINNAME.com",

"subject" : "APP Status Warning",

"body": "{{ctx.watch\_id}} executed with  
{{ctx.payload.hits.total}} hits"

```
  }

}

```

}  
}

If I remove filter" : {"range" :  
{"@timestamp" : {"gte" : "now-5m"}}}, It works fine but it query's the entire index where i want to search only the last 5mins for ENCODE:14310 count greater than 5.  
Can anyone help me here?  
Thanks

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [May 25, 2016, 7:40am UTC](https://discuss.elastic.co/t/watcher-search-for-feild-value-in-last-1mins/50188/2 "2016-05-25T07:40:13Z")

</div>

Hey,

try using the `query` part of your watch as a regular query. I think it wont work either. You should use a `bool` query, that consists of a `filter` and `must` part. The `filter` part contains the timestamp filter and the `must` part contains the `match` query.

Always try to make sure, that your query executes and only then create a watch out of it.

Also, please try a better formatting next time by wrapping everything into correct markdown, which makes it much easier to read.

--Alex

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:45pm UTC](https://discuss.elastic.co/t/watcher-search-for-feild-value-in-last-1mins/50188/3 "2017-07-06T13:45:23Z")

</div>