# Kibana Alerting extraction query not showing the correct count in the output

**URL:** <https://forum.opensearch.org/t/kibana-alerting-extraction-query-not-showing-the-correct-count-in-the-output/8594>\
**Category:** Open Source Elasticsearch and Kibana\
**Tags:** troubleshoot\
**Created:** [February 10, 2022, 12:03pm UTC](https://forum.opensearch.org/t/kibana-alerting-extraction-query-not-showing-the-correct-count-in-the-output/8594 "2022-02-10T12:03:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![manchou101](https://avatars.discourse-cdn.com/v4/letter/m/dfb087/32.png) [@manchou101](https://forum.opensearch.org/u/manchou101)\
**Post date:** [February 10, 2022, 12:03pm UTC](https://forum.opensearch.org/t/kibana-alerting-extraction-query-not-showing-the-correct-count-in-the-output/8594/1 "2022-02-10T12:03:04Z")

</div>

hello team

Im using Opendistro 6.7.1 and trying to create some alerts from Kibana to custom url.

I have attached my query below. Im getting the correct count under discover when filtering with the keyword (eg: “ERROR” and hits = 100+for last 1 hour ) however when I run the query with the same time period, it shows 0

```auto
{
"size": 0,
"query": {
"bool": {
"filter": [
{
"range": {
"@fb_timestamp": {
"from": "now-1h",
"to": null,
"include_lower": true,
"include_upper": true,
"format": "epoch_millis",
"boost": 1
}
}
},
{
"multi_match": {
"query": "ERROR",
"fields": [],
"type": "phrase",
"slop": 0,
"prefix_length": 0,
"max_expansions": 50,
"lenient": false,
"zero_terms_query": "NONE",
"auto_generate_synonyms_phrase_query": true,
"fuzzy_transpositions": true,
"boost": 1
}
}
],
"adjust_pure_negative": true,
"boost": 1
}
},
"aggregations": {}
}

```

Not sure if there is anything is missing from the query ? Any help would be great ! 🙂

---

<div class="post-metadata">

**Author:** ![shaimoh](https://avatars.discourse-cdn.com/v4/letter/s/4da419/32.png) [@shaimoh](https://forum.opensearch.org/u/shaimoh)\
**Post date:** [February 11, 2022, 4:46pm UTC](https://forum.opensearch.org/t/kibana-alerting-extraction-query-not-showing-the-correct-count-in-the-output/8594/2 "2022-02-11T16:46:45Z")

</div>

I’d suggest you to upgrade to the latest opendistro 🙂

---

<div class="post-metadata">

**Author:** ![manchou101](https://avatars.discourse-cdn.com/v4/letter/m/dfb087/32.png) [@manchou101](https://forum.opensearch.org/u/manchou101)\
**Post date:** [February 11, 2022, 4:47pm UTC](https://forum.opensearch.org/t/kibana-alerting-extraction-query-not-showing-the-correct-count-in-the-output/8594/3 "2022-02-11T16:47:20Z")

</div>

@shaimoh  
I think i should die 🙂