Watching Logstash indexes

The watch example at shows how to specify searching all Logstash indexes:

"indices" : [

The same example contains a time filter that limits the search to the five minutes before the schedule search time:

"filter": {
  "range": {
    "@timestamp" : {
      "from": "{{ctx.trigger.scheduled_time}}||-5m",
      "to": "{{ctx.trigger.triggered_time}}"

We keep months of daily Logstash indexes, but only today's index (and occasionaly yesterday's index) can contain events from the preceding five minutes.

Does the Watcher limit its search to the time relevant Logstash indexes? Or is there some other way to specify which Logstash indexes to search?

Joel Shprentz

Hi Joel,
Right now watcher doesn't have the ability to limit the searches to indices by time. You may be able to solve this problem using an index alias to point at the last two days indices and then use the alias in your watch. See
You can also use curator to manage this alias.