ES watch: core dumps query

gistfile1.txt

PUT _watcher/watch/core_dumps_slack
{
    "trigger" : {
        "schedule" : {"interval" : "1m"}
    },
    "input" : {
        "search" : {
            "request" : {
                "body" : {
                    "query": {
                        "bool": {
                            "must": [
                                {"exists": {"field": "session.core_dumps"}},
                                {"range": {"_timestamp": {"from": "now-1m"}}}
                            ]
                        }
                    }
                }
            }
        }
    },
    "condition" : {
        "compare" :  {
            "ctx.payload.hits.total": {"gt": 0}
        }
    },
    "actions" : {
        "notify-slack" : {
            "throttle_period" : "1m",
            "slack" : {
                "message" : {
                    "to" : [ "#new-core-dumps" ], 
                    "text" : "Found {{ctx.payload.hits.total}} new core dumps: {{ctx.payload.hits.hits}}"
                }
            }
        }
    }
}