"query": {
"bool": {
"filter": [
{
"term": {
"event.type": "fruits"
}
},
{
"term": {
"fruit": "or*"
}
},
{
"range": {
"@timestamp": {
"gte": "{{ctx.trigger.triggered_time}}||-{{ctx.metadata.time_period}}"
}
}
}
]
}
}
I would like to filter down to event.type:fruits and then have a watcher for everything starting with or*.
I'm aware that wildcards don't work on filters, but how could I go about using "terms" and "wildcard" inside the same watcher?
Thank you!