scheduled aggregation sends old matches

[oli-morris]

Hi all,

I want a simple alert that catches all events with runtime > 600s and send an email every hour with all matches.
The hourly mail works but I always get matches that have already been listed in the mail before (and before ...).
Any tipps?

type: frequency
index: process *
num_events: 1
timeframe:
  minutes: 1
aggregation:
  schedule: “0 * * * 1-5 *”
aggregate_by_match_time: false

filter:
- query:
    query_string:
      query: "status: \"Finished\""
- range:
    runtime:
      from: 600