# Watching Logstash indexes

**URL:** <https://discuss.elastic.co/t/watching-logstash-indexes/1772>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [June 2, 2015, 7:57pm UTC](https://discuss.elastic.co/t/watching-logstash-indexes/1772 "2015-06-02T19:57:30Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![joelshprentz](https://avatars.discourse-cdn.com/v4/letter/j/c2a13f/32.png) [@joelshprentz](https://discuss.elastic.co/u/joelshprentz)\
**Post date:** [June 2, 2015, 7:57pm UTC](https://discuss.elastic.co/t/watching-logstash-indexes/1772/1 "2015-06-02T19:57:31Z")

</div>

The watch example at [https://www.elastic.co/guide/en/watcher/current/api-rest.html#api-rest-put-watch](https://www.elastic.co/guide/en/watcher/current/api-rest.html#api-rest-put-watch) shows how to specify searching all Logstash indexes:

```
"indices" : [
  "logstash*"
],

```

The same example contains a time filter that limits the search to the five minutes before the schedule search time:

```
"filter": {
  "range": {
    "@timestamp" : {
      "from": "{{ctx.trigger.scheduled_time}}||-5m",
      "to": "{{ctx.trigger.triggered_time}}"
   }
  }
}

```

We keep months of daily Logstash indexes, but only today's index (and occasionaly yesterday's index) can contain events from the preceding five minutes.

Does the Watcher limit its search to the time relevant Logstash indexes? Or is there some other way to specify which Logstash indexes to search?

--  
Joel Shprentz

---

<div class="post-metadata">

**Author:** ![GaelTadh](https://avatars.discourse-cdn.com/v4/letter/g/8e8cbc/32.png) [@GaelTadh](https://discuss.elastic.co/u/GaelTadh)\
**Post date:** [June 2, 2015, 9:33pm UTC](https://discuss.elastic.co/t/watching-logstash-indexes/1772/2 "2015-06-02T21:33:47Z")

</div>

Hi Joel,  
Right now watcher doesn't have the ability to limit the searches to indices by time. You may be able to solve this problem using an index alias to point at the last two days indices and then use the alias in your watch. See [https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-aliases.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-aliases.html)  
You can also use curator [https://www.elastic.co/guide/en/elasticsearch/client/curator/current/index.html](https://www.elastic.co/guide/en/elasticsearch/client/curator/current/index.html) to manage this alias.  
Brian

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:49pm UTC](https://discuss.elastic.co/t/watching-logstash-indexes/1772/3 "2017-07-06T13:49:44Z")

</div>