Trouble Using MongoDB Aggregation Query in Alert Rules

Hi!

I’m trying to query a MongoDB data source and use that to set up a few alerts, but I’m struggling to make it work.

I have a dashboard with a table view where I filter error codes over a time range and aggregate the number of errors. This works fine in the dashboard—it gives me a single value representing how many errors occurred during the selected time range.

Here’s the aggregation query I’m using:

db.Alert.aggregate([
  {
    $match: {
      code: "A8-002",
      timestamp: {
        $gte: new Date($__from),
        $lte: new Date($__to)
      }
    }
  },
  {
    $count: "alertCount"
  }
])

However, when I try to use the same query for alert rules, it doesn’t return any data. I’ve even added a fake ID column to see if that helps, but no luck. The source is the same, and the query is identical.

Has anyone run into this issue? Is there something special I need to do to make aggregation queries work for alert rules?

Thanks in advance!