title: Watcher alert if no records matching filter in x minutes
body: <p>I need to get ElasticSearch watcher to alert if there is no record matching a pattern inserted into the index in a time frame, it needs to be able to do this whilst grouping on another pair of field.
  i.e. the records will be of the pattern:
  Date Timestamp Level Message Client Site</p>
  
  <p>It needs to check that Message matches "is running" for each Client's site(s) (i.e. Google Maps and Bing Maps have the same site of Maps). I tihnk the best(?) way to do this right now is to run a wacher per client site.</p>
  
  <p>Sofar I have this, assume the task should write is running into the log every 20 minutes :</p>
  
  <pre><code>{
    "trigger" : { 
      "schedule" : {
        "interval" : "25m"
      }
    },
    "input" : { 
      "search" : {
        "request" : {
          "search_type" : "count",
          "indices" : "&lt;logstash-{now/d}&gt;",
          "body" : {
            "filtered" : {
              "query" : { 
                "match_phrase" : { "Message" : "Is running" } 
              },
              "filter" : {
                "match" : { "Client" : "Example" } ,
                "match" : { "Site" : "SomeSite" } 
              }
  
            }
          }
        }
      }
    },
    "condition" : { 
      "script" : "return ctx.payload.hits.total &lt; 1"
    },
  
    "actions" : { 
      },
      "email_administrator" : {
        "email" : {
          "to" : "me@host.tld",
          "subject" : "Tasks are not running for {{ctx.payload.client}} on their site {{ctx.payload.site}}",
          "body" : "Too many error in the system, see attached data",
          "attach_data" : true,
          "priority" : "high"
        }
      }
    }
  }
  </code></pre>