In your posted watch, the trigger (when) is too small, should be daily ; then the input is missing (what search) and to apply action (index, email, API...) on specific conditions, use conditions : when the condition(s) is/are true (= met), action will be applied.
You should read the watcher doc and compare conditions doc I linked before. You have good examples on Elastic GitHub repo.
I didn't test my tips/example, so it can be inaccurate.
instead se of ctx.execution_time value, try to use a date variable (<{now+30d}>) in the condition part :
{
"condition" : {
"compare" : {
"ctx.payload.expiry_date" : {
"lte" : "<{now+30d}>"
}
}
}
The expiration warning in on Monitoring view as mentioned by Elastic team in the topic you linked :
Today, we show this information at the top of the Monitoring Cluster Overview screen, which you can click to see more details, including a link to the subscriptions page above