two.json

{
  "_index": "looker",
  "_type": "watch",
  "_id": "vif50fghfed-7xs56mrtk16-55li19hd1um",
  "_version": 1,
  "found": true,
  "_source": {
    "title": "watcher_title",
    "disable": false,
    "report": false,
    "trigger": {
      "schedule": {
        "later": "every 5 mins"
      }
    },
    "input": {
      "chain": {
        "inputs": [
          {
            "first": {
        "search": {
          "request": {
            "index": [
              "<flights-{now/d}>"
            ],
            "body": {
              "query": {
                "bool": {
                  "must": [
                    {
                      "match": {
                        "msg": {
                          "query": "morgan",
                          "type": "phrase"
                        }
                      }
                    },
                    {
                      "match": {
                        "path": {
                          "query": "/flights/v1/reprice",
                          "type": "phrase"
                        }
                      }
                    },
                    {
                      "range": {
                        "status_code": {
                          "gte": 400,
                          "lte": 600
                        }
                      }
                    },
                    {
                      "range": {
                        "@timestamp": {
                          "from": "now-2m",
                          "to": "now"
                        }
                      }
                    }
                  ],
                  "must_not": {
                    "match": {
                      "status_code": {
                        "query": 517,
                        "type": "phrase"
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }},
          {
            "second": {
        "search": {
          "request": {
            "index": [
              "<flights-{now/d-7d}>"
            ],
            "body": {
              "query": {
                "bool": {
                  "must": [
                    {
                      "match": {
                        "msg": {
                          "query": "morgan",
                          "type": "phrase"
                        }
                      }
                    },
                    {
                      "match": {
                        "path": {
                          "query": "/flights/v1/reprice",
                          "type": "phrase"
                        }
                      }
                    },
                    {
                      "range": {
                        "status_code": {
                          "gte": 400,
                          "lte": 600
                        }
                      }
                    },
                    {
                      "range": {
                        "@timestamp": {
                          "from": "now-2m",
                          "to": "now"                        }
                      }
                    }
                  ],
                  "must_not": {
                    "match": {
                      "status_code": {
                        "query": 517,
                        "type": "phrase"
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }}
      ]
      }
      },
    "condition": {
      "script": {
        "script": "first.payload.hits.total > 100"
      }
    },
    "actions": {
      "email_admin": {
        "throttle_period": "0h15m0s",
        "email": {
          "to": "alarm@localhost",
          "from": "sentinl@localhost",
          "subject": "Sentinl Alarm",
          "priority": "high",
          "body": "Found {{payload.hits.total}} Events"
        }
      }
    }
  }
}