# Watchers: querying for multiple strings in timeframe

**URL:** https://discuss.elastic.co/t/watchers-querying-for-multiple-strings-in-timeframe/241211
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [July 15, 2020, 12:21am UTC](https://discuss.elastic.co/t/watchers-querying-for-multiple-strings-in-timeframe/241211 "2020-07-15T00:21:57Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![DatBassie](https://avatars.discourse-cdn.com/v4/letter/d/41988e/32.png) [@DatBassie](https://discuss.elastic.co/u/DatBassie)
#### Post date: [July 15, 2020, 12:21am UTC](https://discuss.elastic.co/t/watchers-querying-for-multiple-strings-in-timeframe/241211/1 "2020-07-15T00:21:57Z")

</div>

Hi everyone,

I've been working to get a watcher configured that will look for either of two options on text in a fields, in ths case `message`.  
Of all those, I'd want to alert if any of them happened in the last, say, thirty minutes.

I have a number of tries, currently:

```auto
{
     "trigger": {
       "schedule": {
         "interval": "30m"
       }
     },
     "input": {
       "search": {
         "request": {
           "body": {
             "size": 5,
             "query": {
               "bool": { 
                 "should": [
                   { "match": { "message": "match1" }},
                   { "match": { "message": "match2" }}
                 ],
                 "filter": [
                   { "range": { "@timestamp": { "gte": "now-30d" }}}
                 ]
               }
             }
           },
           "indices": [
             "wso2ei-errors-*"
           ]
         }
       }
     },
     "condition": {
       "compare": {
         "ctx.payload.hits.total": {
           "gte": 1
         }
       }
     },
     "actions": {
       "my-logging-action": {
         "logging": {
           "text": "There are {{ctx.payload.hits.total}} documents in your index. Threshold is 10."
         }
       }
     }
   }

```

I have gotten \>10000, 0 or a few hundred results. When searching in Discover, I get 21. After a day of trying, I am completely confused as to why that might be... I've tried `message.raw`, along with several different types of queries.

If anyone has any clues as to what might help solve this, I'd be very happy!

Thanks in advance 🙂

---

<div class="post-metadata">

### Author: ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [July 23, 2020, 8:52am UTC](https://discuss.elastic.co/t/watchers-querying-for-multiple-strings-in-timeframe/241211/2 "2020-07-23T08:52:43Z")

</div>

your search in discover was very likely different. can you paste how it looked like?

Note that having a `should` query like this without a `must` part, this will be treated as an OR query. `match1 OR match2`.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 20, 2020, 8:52am UTC](https://discuss.elastic.co/t/watchers-querying-for-multiple-strings-in-timeframe/241211/3 "2020-08-20T08:52:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.