diff --git a/explore-analyze/alerts-cases/watcher/input-http.md b/explore-analyze/alerts-cases/watcher/input-http.md index 65e1fce59a..66ed102288 100644 --- a/explore-analyze/alerts-cases/watcher/input-http.md +++ b/explore-analyze/alerts-cases/watcher/input-http.md @@ -142,7 +142,7 @@ For example, the following snippet uses templates to specify what index to query "host" : "host.domain", "port" : 9200, "path" : "/{{ctx.watch_id}}/_search", - "body" : "{\"query\" : {\"range\": {\"@timestamp\" : {\"from\": \"{{ctx.trigger.triggered_time}}||-5m\",\"to\": \"{{ctx.trigger.triggered_time}}\"}}}}" + "body" : "{\"query\" : {\"range\": {\"@timestamp\" : {\"gte\": \"{{ctx.trigger.triggered_time}}||-5m\",\"lte\": \"{{ctx.trigger.triggered_time}}\"}}}}" } } }