# How limit alerting query?

**URL:** <https://forum.opensearch.org/t/how-limit-alerting-query/2504>\
**Category:** Alerting\
**Created:** [April 1, 2020, 12:41am UTC](https://forum.opensearch.org/t/how-limit-alerting-query/2504 "2020-04-01T00:41:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![cyberzlo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/cyberzlo/32/572_2.png) [@cyberzlo](https://forum.opensearch.org/u/cyberzlo)\
**Post date:** [April 1, 2020, 12:41am UTC](https://forum.opensearch.org/t/how-limit-alerting-query/2504/1 "2020-04-01T00:41:31Z")

</div>

Hi, for alerts I am doing query on _discover_ and then copy it from _inspect_, but there in query date is not relative but absolute. How can I do it in _alerting_ for auto query only for like last 5 minutes or so? What I mean I want query every X minutes which check ES only for reasults from last 5 minutes, not for all records or limited by absolute date (which have no sense).

---

<div class="post-metadata">

**Author:** ![ftianli](https://avatars.discourse-cdn.com/v4/letter/f/58956e/32.png) [@ftianli](https://forum.opensearch.org/u/ftianli)\
**Post date:** [July 8, 2020, 5:33pm UTC](https://forum.opensearch.org/t/how-limit-alerting-query/2504/2 "2020-07-08T17:33:01Z")

</div>

Hi @cyberzlo  
You could use “Range query” to filter the result when defining the monitor, see this for detail: [Range query | Elasticsearch Guide [8.4] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-range-query.html#ranges-on-dates)

In your use case, the query might be: (assume `timestamp` is the field stores the time)

```auto
{
    "query": {
        "range" : {
            "timestamp" : {
                "gte" : "now-5m",
                "lt" : "now"
            }
        }
    }
}

```

And then set the `Monitor Schedule` to run the monitor every X minutes.

Tianli

---

<div class="post-metadata">

**Author:** ![skkosuri-amzn](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/skkosuri-amzn/32/935_2.png) [@skkosuri-amzn](https://forum.opensearch.org/u/skkosuri-amzn)\
**Post date:** [August 31, 2020, 10:32pm UTC](https://forum.opensearch.org/t/how-limit-alerting-query/2504/3 "2020-08-31T22:32:46Z")

</div>