wacther using must

{
  "trigger": {
    "schedule": {
      "interval": "60m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "dslogs-*"
        ],
        "types": [],
        "body": {
          "query": {
            "bool": {
              "must": [
                {
                  "term": {
                    "beat.ip": "10.7.1.109"
                  }
                },
                {
                  "term": {
                    "levelname": "CRITICAL"
                  }
                }
              ],
              "filter": [
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-60m"
                    }
                  }
                }
              ]
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gt": 0
      }
    }
  },
  "actions": {
    "notify-pagerduty": {
      "throttle_period_in_millis": 300000,
      "pagerduty": {
        "description": "ATTENTION: critical logs found in last 1hour and triggered at {{ctx.execution_time}}",
        "client_url": "https://kibana1.corp.mycompany.com/",
        "attach_payload": true,
        "account": "team1",
        "contexts": [
          {
            "type": "link",
            "href": "https://mycompany.pagerduty.com"
          },
          {
            "type": "link",
            "href": "https://mycompany.pagerduty.com",
            "text": "View the incident on {{ctx.payload.link}}"
          }
        ]
      }
    }
  }
}

wacther using should

{
  "trigger": {
    "schedule": {
      "interval": "60m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "dslogs-*"
        ],
        "types": [],
        "body": {
          "query": {
            "bool": {
              "must": [
                {
                  "term": {
                    "beat.ip": "10.7.1.109"
                  }
                }
              ],
              "filter": [
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-60m"
                    }
                  }
                }
              ],
              "should": [
                {
                  "match_phrase": {
                    "levelname": "CRITICAL"
                  }
                }
              ],
              "minimum_should_match": 1
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gt": 0
      }
    }
  },
  "actions": {
    "notify-pagerduty": {
      "throttle_period_in_millis": 300000,
      "pagerduty": {
        "description": "ATTENTION: critical logs found in last 1hour and triggered at {{ctx.execution_time}}",
        "client_url": "https://kibana1.corp.mycompany.com/",
        "attach_payload": true,
        "account": "team1",
        "contexts": [
          {
            "type": "link",
            "href": "https://mycompany.pagerduty.com"
          },
          {
            "type": "link",
            "href": "https://mycompany.pagerduty.com",
            "text": "View the incident on {{ctx.payload.link}}"
          }
        ]
      }
    }
  }
}