# Adding watcher condition

**URL:** <https://discuss.elastic.co/t/adding-watcher-condition/326763>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [March 1, 2023, 1:43pm UTC](https://discuss.elastic.co/t/adding-watcher-condition/326763 "2023-03-01T13:43:05Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![alextg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alextg/32/137075_2.png) [@alextg](https://discuss.elastic.co/u/alextg)\
**Post date:** [March 1, 2023, 1:43pm UTC](https://discuss.elastic.co/t/adding-watcher-condition/326763/1 "2023-03-01T13:43:05Z")

</div>

Hello,  
I'm looking to add a new condition to my working watcher. Currently, it alerts when the index doesn't received logs in the last 10 minutes (see below). The functionality I'm trying to add is to alert when the index have received logs in the last 30 minutes, but not in the last 10 minutes. Please advise what I need to add to this working watcher. FYI, I looked into [this](https://github.com/elastic/examples/tree/master/Alerting/Sample%20Watches/system_fails_to_provide_data), but it doesn't work as expected, probably cause it was build for version 7.x and I use 8.6

```auto
PUT _watcher/watch/my-watcher
{
  "trigger": {
    "schedule": {
      "interval": "5m"
    }
  },
  "input": {
    "search": {
      "request": {
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "filter": {
                "range": {
                  "timestamp": {
                    "gte": "{{ctx.trigger.scheduled_time}}||-10m",
                    "lte": "{{ctx.trigger.scheduled_time}}",
                    "format": "strict_date_optional_time||epoch_millis"
                  }
                }
              }
            }
          }
        },
        "indices": [
          "my_index"
        ]
      }
    }
  },
  "condition": {
    "script": {
      "source": "if (ctx.payload.hits.total <= params.threshold) { return true; } return false;",
      "params": {
        "threshold": 0
      }
    }
  },
  "transform": {
    "script": {
      "source": "HashMap result = new HashMap(); result.result = ctx.payload.hits.total; return result;",
      "params": {
        "threshold": 0
      }
    }
  },
  "actions": {
    "logging_1": {
      "logging": {
        "text": "Watch [{{ctx.metadata.name}}] has exceeded the threshold"
      }
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [March 2, 2023, 2:47pm UTC](https://discuss.elastic.co/t/adding-watcher-condition/326763/2 "2023-03-02T14:47:39Z")

</div>

Take a look at this example:

> <https://gist.github.com/richcollier/32d291d9b960d903864113a211dbbb23>

---

<div class="post-metadata">

**Author:** ![alextg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alextg/32/137075_2.png) [@alextg](https://discuss.elastic.co/u/alextg)\
**Post date:** [March 8, 2023, 7:24pm UTC](https://discuss.elastic.co/t/adding-watcher-condition/326763/3 "2023-03-08T19:24:56Z")

</div>

Not able to get your example to work, not sure if the mapping I'm using is correct, see below, please advise.

```auto
{
  "my_index": {
    "mappings": {
      "properties": {
        "simple_property": {
          "type": "keyword"
        },
        "timestamp": {
          "type": "date"
        }
      }
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [March 8, 2023, 9:46pm UTC](https://discuss.elastic.co/t/adding-watcher-condition/326763/4 "2023-03-08T21:46:13Z")

</div>

1. my example uses `@timestamp` and your index has `timestamp`
2. my example uses index wildcards `"al*", "stir*"` and your index name is `my_index`

so you'll need to change those differences, for sure.

---

<div class="post-metadata">

**Author:** ![alextg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alextg/32/137075_2.png) [@alextg](https://discuss.elastic.co/u/alextg)\
**Post date:** [March 8, 2023, 10:16pm UTC](https://discuss.elastic.co/t/adding-watcher-condition/326763/5 "2023-03-08T22:16:06Z")

</div>

In my last post, I showed the mapping of the index I'm using called "my\_index" by running this from the console

```auto
GET my_index/_mapping?pretty

```

If possible, could you show the mapping of one of your indexes?

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [March 8, 2023, 11:35pm UTC](https://discuss.elastic.co/t/adding-watcher-condition/326763/6 "2023-03-08T23:35:03Z")

</div>

Sure!

```auto
  "alarm-messages": {
    "mappings": {
      "_meta": {
        "created_by": "file-data-visualizer"
      },
      "properties": {
        "@timestamp": {
          "type": "date"
        },
        "AHostname": {
          "type": "keyword"
        },
        "AHostname_keyword": {
          "type": "keyword"
        },
        "ActiveMins": {
          "type": "long"
        },
        "ActiveMins_keyword": {
          "type": "long"
        },
        "AlarmKey": {
          "type": "text"
        },
        "AlarmKey_keyword": {
          "type": "text"
        },
        "AlarmType": {
          "type": "keyword"
        },
        "AlarmType_keyword": {
          "type": "keyword"
        },
        "AlertCategory": {
          "type": "keyword"
        },
        "AlertCategory_keyword": {
          "type": "keyword"
        },
        "CaseDescription": {
          "type": "keyword"
        },
        "CaseDescription_keyword": {
          "type": "keyword"
        },
        "Cause": {
          "type": "keyword"
        },
        "Cause_keyword": {
          "type": "keyword"
        },
        "Domain": {
          "type": "keyword"
        },
        "Domain_keyword": {
          "type": "keyword"
        },
        "ElementName": {
          "type": "keyword"
        },
        "ElementName_keyword": {
          "type": "keyword"
        },
        "ElementType": {
          "type": "keyword"
        },
        "ElementType_keyword": {
          "type": "keyword"
        },
        "EventStatus": {
          "type": "keyword"
        },
        "EventStatus_keyword": {
          "type": "keyword"
        },
        "FirstAlertedTS": {
          "type": "date",
          "format": "epoch_second"
        },
        "FirstAlertedTS_keyword": {
          "type": "date",
          "format": "epoch_second"
        },
        "KPIMeasure": {
          "type": "keyword"
        },
        "KPIMeasure_keyword": {
          "type": "keyword"
        },
        "LatestAlertedTS": {
          "type": "date",
          "format": "epoch_second"
        },
        "LatestAlertedTS_keyword": {
          "type": "date",
          "format": "epoch_second"
        },
        "ManagerClass": {
          "type": "keyword"
        },
        "ManagerClass_keyword": {
          "type": "keyword"
        },
        "NEID": {
          "type": "keyword"
        },
        "NEID_keyword": {
          "type": "keyword"
        },
        "Network": {
          "type": "keyword"
        },
        "Network_keyword": {
          "type": "keyword"
        },
        "ProductName": {
          "type": "keyword"
        },
        "ProductName_keyword": {
          "type": "keyword"
        },
        "SendtoNOC": {
          "type": "keyword"
        },
        "SendtoNOC_keyword": {
          "type": "keyword"
        },
        "Severity": {
          "type": "keyword"
        },
        "Severity_keyword": {
          "type": "keyword"
        },
        "SourceEventID": {
          "type": "keyword"
        },
        "SourceEventID_keyword": {
          "type": "keyword"
        },
        "SourceEventType": {
          "type": "keyword"
        },
        "SourceEventType_keyword": {
          "type": "keyword"
        },
        "SourceSystem": {
          "type": "keyword"
        },
        "SourceSystem_keyword": {
          "type": "keyword"
        },
        "SubSourceType": {
          "type": "keyword"
        },
        "SubSourceType_keyword": {
          "type": "keyword"
        },
        "ThresholdValue": {
          "type": "long"
        },
        "ThresholdValue_keyword": {
          "type": "long"
        },
        "TriggerDescription": {
          "type": "text"
        },
        "TriggerDescription_keyword": {
          "type": "text"
        },
        "TriggerUnitsofMeasure": {
          "type": "keyword"
        },
        "TriggerUnitsofMeasure_keyword": {
          "type": "keyword"
        },
        "TriggerValue": {
          "type": "long"
        },
        "deviceCLLI": {
          "type": "keyword"
        },
        "deviceCLLI_keyword": {
          "type": "keyword"
        },
        "insertTimestamp": {
          "type": "date",
          "format": "MMM d, yyyy @ HH:mm:ss.SSS"
        },
        "name": {
          "type": "keyword"
        },
        "name_keyword": {
          "type": "keyword"
        }
      }
    }
  },

```

---

<div class="post-metadata">

**Author:** ![alextg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alextg/32/137075_2.png) [@alextg](https://discuss.elastic.co/u/alextg)\
**Post date:** [March 9, 2023, 2:23pm UTC](https://discuss.elastic.co/t/adding-watcher-condition/326763/7 "2023-03-09T14:23:10Z")

</div>

The timestamp was causing issues. Your example is working as expected. Thanks for the feedback!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 6, 2023, 2:23pm UTC](https://discuss.elastic.co/t/adding-watcher-condition/326763/8 "2023-04-06T14:23:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.