# Advanced Watcher Alternative input

**URL:** <https://discuss.elastic.co/t/advanced-watcher-alternative-input/290455>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting\
**Created:** [November 29, 2021, 3:57pm UTC](https://discuss.elastic.co/t/advanced-watcher-alternative-input/290455 "2021-11-29T15:57:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![zangero98](https://avatars.discourse-cdn.com/v4/letter/z/a587f6/32.png) [@zangero98](https://discuss.elastic.co/u/zangero98)\
**Post date:** [November 29, 2021, 3:57pm UTC](https://discuss.elastic.co/t/advanced-watcher-alternative-input/290455/1 "2021-11-29T15:57:16Z")

</div>

Hi,  
I want to specify an advanced watch with an alternative input. Right now I am matching all logs in the syntax, but i just want to match fileset.name = firewall  
I'm an elastic beginner and so I'm not very familiar with the JSON structure 😅  
Can somebody give me the syntax for "Alternative input"? 🙂

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/3/b32b931689ba05fcc40ec0aef7edcfc4fed35b97.png)

---

<div class="post-metadata">

**Author:** ![cjcenizal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cjcenizal/32/11216_2.png) [@cjcenizal](https://discuss.elastic.co/u/cjcenizal)\
**Post date:** [December 1, 2021, 11:43pm UTC](https://discuss.elastic.co/t/advanced-watcher-alternative-input/290455/2 "2021-12-01T23:43:57Z")

</div>

Hi @zangero98, to clarify the UI you're looking at is for _simulating_ the watch that you're defining. The specific "Alternative input" text box from your screenshot is for "faking" the input that would be returned by your definition of the [watcher `input` field](https://www.elastic.co/guide/en/elasticsearch/reference/current/input.html). This can be any JSON object you like. The purpose of this UI is to experiment with the watch and see how it behaves under in different user-defined scenarios.

However, it doesn't sound like this is quite relevant to your goal. You said you're matching all logs, and you want to define a condition so you only match a subset of those logs. This sounds like you want to define a `search` for the `input` field, in which you can write the Elasticsearch query for retrieving logs that match your condition. Here are the docs on how to define a `search` for the `input` field: [Watcher search input | Elasticsearch Guide [7.15] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/input-search.html).

Here is where you can get started learning how to define filters in your query: [Query and filter context | Elasticsearch Guide [7.15] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-filter-context.html#filter-context)

Does this help?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 29, 2021, 11:44pm UTC](https://discuss.elastic.co/t/advanced-watcher-alternative-input/290455/3 "2021-12-29T23:44:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.