Configure monitor query with limitation on aggeration

OpenSearch
1

Hello,
I am trying to configure a monitor that looks at data logged by cron jobs.
I want to trigger an alert if a job does stop to log data.
The query using SQL looks something like this:

POST _plugins/_sql/
{
  "query" : "SELECT instance, job-id, count(*), max(@timestamp) as newest FROM job-statistics-* where @timestamp > '2022-09-28 00:00:00.000' group BY job-id, instance HAVING newest < '2022-09-28 08:45:00.000'"
}

Using exlplain I converted this to a JSON Query and made the timestamp dynamic:

{
    "from": 0,
    "size": 0,
    "timeout": "1m",
    "query": {
        "range": {
            "@timestamp": {
                "from": "now-1h",
                "to": null,
                "include_lower": false,
                "include_upper": true,
                "boost": 1
            }
        }
    },
    "sort": [
        {
            "_doc": {
                "order": "asc"
            }
        }
    ],
    "aggregations": {
        "composite_buckets": {
            "composite": {
                "size": 1000,
                "sources": [
                    {
                        "job-id": {
                            "terms": {
                                "field": "job-id.keyword",
                                "missing_bucket": true,
                                "missing_order": "first",
                                "order": "asc"
                            }
                        }
                    },
                    {
                        "instance": {
                            "terms": {
                                "field": "instance.keyword",
                                "missing_bucket": true,
                                "missing_order": "first",
                                "order": "asc"
                            }
                        }
                    }
                ]
            },
            "aggregations": {
                "count(*)": {
                    "value_count": {
                        "field": "_index"
                    }
                },
                "max(@timestamp)": {
                    "max": {
                        "field": "@timestamp"
                    }
                }
            }
        }
    }
}

From this query, the limitation on the aggeration max(@timestmap) is missing.
In the explain response it is here:

        "name": "FilterOperator",
        "description": {
          "conditions": """<(max(@timestamp), cast_to_timestamp("2022-09-28 08:45:00.000"))"""
        },

Ideally, this should be max(@timestmap) < now-30min
My question:
How can I integrate this into the query or the monitor?
Is there another way to do this?

Thanks a lot
Marius