From 758433a0fa36e8d9eb7387e49b13b046d70bc4cd Mon Sep 17 00:00:00 2001
From: Alexander Reelsen <alexander@reelsen.net>
Date: Fri, 15 Dec 2017 15:23:57 +0100
Subject: [PATCH] Monitoring: Ensure all monitoring watches filter by timestamp
 (elastic/x-pack-elasticsearch#3238)

Only the Logstash and Kibana version mismatch watches contain a time
filter, the others are only sorting by timestamp. In combination with
searching in all `.monitoring-es-*` indices, this is IMO pretty resource
intensive, as we cannot exit early on any search request.

This commit adds time based filters to remaining three watches, using
the same range than the other two.

Original commit: elastic/x-pack-elasticsearch@3eb6bf0de2b9fb36564717e22a9f406457c0bddc
---
 .../monitoring/watches/elasticsearch_cluster_status.json   | 7 +++++++
 .../monitoring/watches/elasticsearch_version_mismatch.json | 7 +++++++
 .../monitoring/watches/xpack_license_expiration.json       | 7 +++++++
 3 files changed, 21 insertions(+)

diff --git a/plugin/src/main/resources/monitoring/watches/elasticsearch_cluster_status.json b/plugin/src/main/resources/monitoring/watches/elasticsearch_cluster_status.json
index e5639c0bb1d..c0a13ea63a6 100644
--- a/plugin/src/main/resources/monitoring/watches/elasticsearch_cluster_status.json
+++ b/plugin/src/main/resources/monitoring/watches/elasticsearch_cluster_status.json
@@ -61,6 +61,13 @@
                               }
                             ]
                           }
+                        },
+                        {
+                          "range": {
+                            "timestamp": {
+                              "gte": "now-2m"
+                            }
+                          }
                         }
                       ]
                     }
diff --git a/plugin/src/main/resources/monitoring/watches/elasticsearch_version_mismatch.json b/plugin/src/main/resources/monitoring/watches/elasticsearch_version_mismatch.json
index 04328cdddb3..7e18c981f0f 100644
--- a/plugin/src/main/resources/monitoring/watches/elasticsearch_version_mismatch.json
+++ b/plugin/src/main/resources/monitoring/watches/elasticsearch_version_mismatch.json
@@ -54,6 +54,13 @@
                               }
                             ]
                           }
+                        },
+                        {
+                          "range": {
+                            "timestamp": {
+                              "gte": "now-2m"
+                            }
+                          }
                         }
                       ]
                     }
diff --git a/plugin/src/main/resources/monitoring/watches/xpack_license_expiration.json b/plugin/src/main/resources/monitoring/watches/xpack_license_expiration.json
index 2fa2a06249c..a05198a15eb 100644
--- a/plugin/src/main/resources/monitoring/watches/xpack_license_expiration.json
+++ b/plugin/src/main/resources/monitoring/watches/xpack_license_expiration.json
@@ -51,6 +51,13 @@
                           "term": {
                             "type": "cluster_stats"
                           }
+                        },
+                        {
+                          "range": {
+                            "timestamp": {
+                              "gte": "now-2m"
+                            }
+                          }
                         }
                       ]
                     }