# X-Pack Watcher - Trigger time drift gap

**URL:** <https://discuss.elastic.co/t/x-pack-watcher-trigger-time-drift-gap/165600>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [January 24, 2019, 12:24pm UTC](https://discuss.elastic.co/t/x-pack-watcher-trigger-time-drift-gap/165600 "2019-01-24T12:24:45Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Steve\_Stevens](https://avatars.discourse-cdn.com/v4/letter/s/50afbb/32.png) [@Steve\_Stevens](https://discuss.elastic.co/u/Steve_Stevens)\
**Post date:** [January 24, 2019, 12:24pm UTC](https://discuss.elastic.co/t/x-pack-watcher-trigger-time-drift-gap/165600/1 "2019-01-24T12:24:46Z")

</div>

Afternoon all!

I'm using X-Pack Watchers in Kibana to poll the logs every 1 minute for particular faults.  
The watcher itself is set to trigger every "1m":  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/5/256c53edaed21c522b324f0e7224a32f468c56c9.png)

and to query (amongst other things) for logs between 1m of the scheduled time:  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/2/0240cac50e49b92cdae24beef4488d3c1476ea06.png)

This is working well, however, I have noticed that the trigger time is actually slightly drifting by ~100ms between every execution.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/2/2241cd144c9c28098a6080509ff36a2f880329c1.png)

We've seen already some logs being missed as part of our alert due to falling between this 100ms gap.  
Does anyone have any suggestions for me to improve the trigger time so that the gap is closed?

Thanks in advance!  
Steve

---

<div class="post-metadata">

**Author:** ![Steve\_Stevens](https://avatars.discourse-cdn.com/v4/letter/s/50afbb/32.png) [@Steve\_Stevens](https://discuss.elastic.co/u/Steve_Stevens)\
**Post date:** [January 28, 2019, 12:18pm UTC](https://discuss.elastic.co/t/x-pack-watcher-trigger-time-drift-gap/165600/2 "2019-01-28T12:18:44Z")

</div>

I tried a couple of alternate approaches but it appears that "1m" uses last triggered time as the start of its next scheduled operation. This would explain the drift (though that is speculation).

Instead, I tried a cron based schedule:  
"trigger": {  
"schedule": {  
"cron": "0 \*/1 \* \* \* ?"  
}  
},

which, when you look at the trigger\_event, seems to force the scheduled time to be on-the-dot:  
"trigger\_event": {  
"type": "schedule",  
"triggered\_time": "2019-01-28T12:14:00.209Z",  
"schedule": {  
"scheduled\_time": "2019-01-28T12:14:00.000Z"  
}  
},

Whilst the execution still happens "ms" after the schedule time, the query is now at least scheduling based on the exact minute.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 25, 2019, 12:18pm UTC](https://discuss.elastic.co/t/x-pack-watcher-trigger-time-drift-gap/165600/3 "2019-02-25T12:18:50Z")

</div>

Closed on February 25, 2019, 12:18pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.