Watcher sometimes input-search hits.total return 0

my watcher json

{
        "trigger": {
          "schedule": {
            "interval": "30m"
          }
        },
        "input": {
          "search": {
            "request": {
              "search_type": "query_then_fetch",
              "indices": [
                "server-redis-info-*"
              ],
              "rest_total_hits_as_int": true,
              "body": {
                "size": 0,
                "query": {
                  "bool": {
                    "filter": [
                      {
                        "term": {
                          "cluster.name.keyword": "shopping"
                        }
                      },
                      {
                        "range": {
                          "@timestamp": {
                            "lt": "now",
                            "format": "yyyy-MM-dd HH:mm:ss",
                            "gte": "now-10m",
                            "time_zone": "+08:00"
                          }
                        }
                      }
                    ]
                  }
                },
                "aggs": {
                  "redis_ip": {
                    "terms": {
                      "field": "redis.ip.keyword"
                    },
                    "aggs": {
                      "date": {
                        "terms": {
                          "size": 1,
                          "order": {
                            "_key": "desc"
                          },
                          "field": "redis.date.keyword"
                        },
                        "aggs": {
                          "used_memory": {
                            "max": {
                              "field": "redis.memory_used"
                            }
                          },
                          "max_memory": {
                            "max": {
                              "field": "redis.maxmemory"
                            }
                          }
                        }
                      }
                    }
                  }
                }
              }
            }
          }
        },
        "condition": {
          "script": {
            "source": "def buckets = ctx.payload.aggregations.redis_ip.buckets;if(buckets.size()==0){return false;}for(int i = 0;i<buckets.size();i++){def date_buckets = buckets[i].date.buckets;def date_buckets_size = date_buckets.size();if (date_buckets_size>=1){double mem_ratio=buckets[i].date.buckets[0].used_memory.value/buckets[i].date.buckets[0].max_memory.value;if(mem_ratio>=ctx.metadata.mem_threshold){return true;}}}",
            "lang": "painless"
          }
        },
        "actions": {
          "send_email": {
            "email": {
              "profile": "standard",
              "to": [
                "{{ctx.metadata.mail}}"
              ],
              "subject": "【内部】Redis预警 shopping集群 {{ctx.payload.now}}  内存使用率预警",
              "body": {
                "html": "{{ctx.payload.message}}"
              }
            }
          },
          "send_phone": {
            "transform": {
              "script": {
                "source": "def buckets=ctx.payload.buckets;def now=buckets[0].date.buckets[0].key;def msg=now;for(int i=0;i<buckets.size();i++){String ip=buckets[i].key;double men_ratio=buckets[i].date.buckets[0].used_memory.value/buckets[i].date.buckets[0].max_memory.value;if(men_ratio>=ctx.metadata.mem_threshold){msg+='内存使用率超过阈值'+ctx.metadata.mem_threshold *100+'%,详情见邮件。';break;}}return ['msg': msg,'now':now];",
                "lang": "painless"
              }
            },
            "webhook": {
              "scheme": "http",
              "host": "*",
              "port": *,
              "method": "get",
              "path": "*",
              "params": {
                "type": "set",
                "token": "c19fb804032454eca3a06f73f30f075f",
                "req": "{\"option\":\"smsMu\",\"mobile\":\"{{ctx.metadata.phone}}\",\"content\":\"【内部】Redis预警 shopping集群 {{ctx.payload.msg}}\"}"
              },
              "headers": {}
            }
          }
        },
        "metadata": {
          "mem_threshold": 0,
          "mail": "*",
          "phone": "*",
          "cpu_threshold": 0
        },
        "transform": {
          "script": {
            "source": "def buckets=ctx.payload.aggregations.redis_ip.buckets;def now=buckets[0].date.buckets[0].key;def message='您好!<br/>';for(int i=0;i<buckets.size();i++){String ip=buckets[i].key;double men_ratio=buckets[i].date.buckets[0].used_memory.value/buckets[i].date.buckets[0].max_memory.value;if(men_ratio>=ctx.metadata.mem_threshold){men_ratio=men_ratio*100;double percent= (double) Math.round(men_ratio * 100) / 100;def threshold=ctx.metadata.mem_threshold *100;message+=now+'  redis_ip:'+ip+',内存使用率:'+percent+'%,已超过预警值'+threshold+'%,请及时关注并处理。<br/>';}}return ['message': message,'now':now,'buckets':buckets];",
            "lang": "painless"
          }
        }
      }

auto Executed return json

{
      "watch_id": "SYS-Redis-shopping_mem_used-cpu_used-clients_connected",
      "node": "_l1skiSNRNuGt0ilk0_Qsg",
      "state": "execution_not_needed",
      "user": "fenggao",
      "status": {
        "state": {
          "active": true,
          "timestamp": "2020-06-11T09:54:42.979Z"
        },
        "last_checked": "2020-06-11T10:01:54.037Z",
        "actions": {
          "send_phone": {
            "ack": {
              "timestamp": "2020-06-11T09:54:42.979Z",
              "state": "awaits_successful_execution"
            }
          },
          "send_email": {
            "ack": {
              "timestamp": "2020-06-11T09:54:42.979Z",
              "state": "awaits_successful_execution"
            }
          }
        },
        "execution_state": "execution_not_needed",
    "version": -1
      },
      "trigger_event": {
    "type": "schedule",
    "triggered_time": "2020-06-11T10:01:54.037Z",
    "schedule": {
      "scheduled_time": "2020-06-11T10:01:53.673Z"
    }
      },
      "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "server-redis-info-*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "filter": [
                {
                  "term": {
                    "cluster.name.keyword": "shopping"
                  }
                },
                {
                  "range": {
                    "@timestamp": {
                      "lt": "now",
                      "format": "yyyy-MM-dd HH:mm:ss",
                      "gte": "now-10m",
                      "time_zone": "+08:00"
                    }
                  }
                }
              ]
            }
          },
          "aggs": {
            "redis_ip": {
              "terms": {
                "field": "redis.ip.keyword"
              },
              "aggs": {
                "date": {
                  "terms": {
                    "size": 1,
                    "order": {
                      "_key": "desc"
                    },
                    "field": "redis.date.keyword"
                  },
                  "aggs": {
                    "used_memory": {
                      "max": {
                        "field": "redis.memory_used"
                      }
                    },
                    "max_memory": {
                      "max": {
                        "field": "redis.maxmemory"
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
      },
      "condition": {
    "script": {
      "source": "def buckets = ctx.payload.aggregations.redis_ip.buckets;if(buckets.size()==0){return false;}for(int i = 0;i<buckets.size();i++){def date_buckets = buckets[i].date.buckets;def date_buckets_size = date_buckets.size();if (date_buckets_size>=1){double mem_ratio=buckets[i].date.buckets[0].used_memory.value/buckets[i].date.buckets[0].max_memory.value;if(mem_ratio>=ctx.metadata.mem_threshold){return true;}}}",
      "lang": "painless"
    }
      },
      "metadata": {
    "mem_threshold": 0,
    "mail": "*",
    "phone": "*",
    "name": "【内部】redis shopping集群内存使用率>=80% OR CPU使用率>=80% OR 客户端连接数 >=100",
    "cpu_threshold": 0,
    "xpack": {
      "type": "json"
    }
      },
      "result": {
    "execution_time": "2020-06-11T10:01:54.037Z",
    "execution_duration": 209,
    "input": {
      "type": "search",
      "status": "success",
      "payload": {
        "_shards": {
          "total": 393,
          "failed": 0,
          "successful": 393,
          "skipped": 392
        },
        "hits": {
          "hits": [],
          "total": 0,
          "max_score": null
        },
        "took": 204,
        "timed_out": false,
        "aggregations": {
          "redis_ip": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": []
          }
        }
      },
      "search": {
        "request": {
          "search_type": "query_then_fetch",
          "indices": [
            "server-redis-info-*"
          ],
          "rest_total_hits_as_int": true,
          "body": {
            "size": 0,
            "query": {
              "bool": {
                "filter": [
                  {
                    "term": {
                      "cluster.name.keyword": "shopping"
                    }
                  },
                  {
                    "range": {
                      "@timestamp": {
                        "lt": "now",
                        "format": "yyyy-MM-dd HH:mm:ss",
                        "gte": "now-10m",
                        "time_zone": "+08:00"
                      }
                    }
                  }
                ]
              }
            },
            "aggs": {
              "redis_ip": {
                "terms": {
                  "field": "redis.ip.keyword"
                },
                "aggs": {
                  "date": {
                    "terms": {
                      "size": 1,
                      "order": {
                        "_key": "desc"
                      },
                      "field": "redis.date.keyword"
                    },
                    "aggs": {
                      "used_memory": {
                        "max": {
                          "field": "redis.memory_used"
                        }
                      },
                      "max_memory": {
                        "max": {
                          "field": "redis.maxmemory"
                        }
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    },
    "condition": {
      "type": "script",
      "status": "success",
      "met": false
    },
    "actions": []
      },
      "messages": []
    } 

why dsl query hits return 0 ?

"hits": {
          "hits": [],
          "total": 0,
          "max_score": null
        },

i can get htis in the dev tools by using the same dsl .

See https://www.elastic.co/guide/en/elasticsearch/reference/current/watcher-limitations.html#_security_integration

Are you also the user fenggao in dev tools console, when testing this?