percolate can be run when there is any updates on the document and we can identify any rules matching the document. But how can we use this to find documents where a datetime field value is 2 days away, like, find open tickets and 2 days before their expected closed date.
1 Answers
you can do this with Alerting, which is probably better suited
without knowing your mappings, https://github.com/elastic/examples/tree/master/Alerting/Sample%20Watches/lateral_movement_in_user_comm has an example of a Watch that compares two different timestamps that you should be able to adopt
Related