@Override
    public CheckResult runCheck() {
        String filter = buildQueryFilter(stream.getId(), query);
        String query = field + ":\"" + value + "\"";
        Integer backlogSize = getBacklog();
        boolean backlogEnabled = false;
        int searchLimit = 1;

        if(backlogSize != null && backlogSize > 0) {
            backlogEnabled = true;
            searchLimit = backlogSize;
        }

        try {
            SearchResult result = searches.search(
                query,
                filter,
                RelativeRange.create(configuration.getAlertCheckInterval()),
                searchLimit,
                0,
                new Sorting(Message.FIELD_TIMESTAMP, Sorting.Direction.DESC)
            );

            final List<MessageSummary> summaries;
            if (backlogEnabled) {
                summaries = Lists.newArrayListWithCapacity(result.getResults().size());
                for (ResultMessage resultMessage : result.getResults()) {
                    final Message msg = resultMessage.getMessage();
                    summaries.add(new MessageSummary(resultMessage.getIndex(), msg));
                }
            } else {
                summaries = Collections.emptyList();
            }

            final long count = result.getTotalResults();

            final String resultDescription = "Stream received messages matching <" + query + "> "
                + "(Current grace time: " + grace + " minutes)";

            if (count > 0) {
                LOG.debug("Alert check <{}> found [{}] messages.", id, count);
                return new CheckResult(true, this, resultDescription, Tools.nowUTC(), summaries);
            } else {
                LOG.debug("Alert check <{}> returned no results.", id);
                return new NegativeCheckResult();
            }
        } catch (InvalidRangeParametersException e) {
            // cannot happen lol
            LOG.error("Invalid timerange.", e);
            return null;
        }
    }
@Test
    public void testRunMatchingMessagesInStream() throws Exception {
        final ResultMessage searchHit = resultMessageFactory.parseFromSource("some_id", "graylog_test",
                Collections.singletonMap("message", "something is in here"));

        final DateTime now = DateTime.now(DateTimeZone.UTC);
        final IndexRange indexRange = MongoIndexRange.create("graylog_test", now.minusDays(1), now, now, 0);
        final Set<IndexRange> indexRanges = Sets.newHashSet(indexRange);
        final SearchResult searchResult = spy(new SearchResult(Collections.singletonList(searchHit),
            1L,
            indexRanges,
            "message:something",
            null,
            100L));
        when(searchResult.getTotalResults()).thenReturn(1L);
        when(searches.search(
            anyString(),
            anyString(),
            any(RelativeRange.class),
            anyInt(),
            anyInt(),
            any(Sorting.class)))
            .thenReturn(searchResult);
        final FieldContentValueAlertCondition condition = getCondition(getParametersMap(0, "message", "something"), "Alert Condition for testing");

        final AlertCondition.CheckResult result = condition.runCheck();

        assertTriggered(condition, result);
    }