1

percolate can be run when there is any updates on the document and we can identify any rules matching the document. But how can we use this to find documents where a datetime field value is 2 days away, like, find open tickets and 2 days before their expected closed date.

Pratyush Dhanuka
  • 1,405
  • 2
  • 11
  • 21

1 Answers1

0

you can do this with Alerting, which is probably better suited

without knowing your mappings, https://github.com/elastic/examples/tree/master/Alerting/Sample%20Watches/lateral_movement_in_user_comm has an example of a Watch that compares two different timestamps that you should be able to adopt

warkolm
  • 1,933
  • 1
  • 4
  • 12