# Advancing alert using watcher
**URL:** https://discuss.elastic.co/t/advancing-alert-using-watcher/150048
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [September 26, 2018, 3:56pm UTC](https://discuss.elastic.co/t/advancing-alert-using-watcher/150048 "2018-09-26T15:56:37Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)
#### Post date: [September 26, 2018, 3:56pm UTC](https://discuss.elastic.co/t/advancing-alert-using-watcher/150048/1 "2018-09-26T15:56:37Z")
HI Team,
I'm very new watcher part and i want to create one alert, please help me on this alert.
My scenario:
i want to compare one field which i stored on the index for certain time period.
for example: In the 1m of time interval if i got that value more than 5 i want to trigger the alert. and i want bring that event word in subject,
please find my below code,
```
{
"trigger": {
"schedule": {
"interval": "1m"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"index"
],
"types": [],
"body": {
"size": 0,
"query": {
"match": {
"headers.httpStatusCode": "200"
}
}
}
}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gte": 5
}
}
},
"actions": {
"send_email": {
"email": {
"profile": "standard",
"to": [
"xxxx@xx.com"
],
"subject": "cardinality Alert",
"body": {
"text": "Respective value has been occured more than 5 time in a min"
}
}
}
}
}
```
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [September 26, 2018, 7:03pm UTC](https://discuss.elastic.co/t/advancing-alert-using-watcher/150048/2 "2018-09-26T19:03:53Z")
hey,
can you explain what you mean with `event word in subject`. What exactly do you refer to? Are you talking about the hits of a search response?
--Alex
---
### Author:  [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)
#### Post date: [September 27, 2018, 4:22am UTC](https://discuss.elastic.co/t/advancing-alert-using-watcher/150048/3 "2018-09-27T04:22:04Z")
event mean field which i'm comparing and i want to show that word in body of the message.
Alert trigger should happen only when the condition is matched
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [September 27, 2018, 11:01am UTC](https://discuss.elastic.co/t/advancing-alert-using-watcher/150048/4 "2018-09-27T11:01:55Z")
sorry, but this is impossible to follow if you dont take some more time to explain the use-case, showing sample documents, showing the query you want to match so that others understand what you are trying to do. At least I do have a hard time to figure out the requirement here.
Thanks!
---
### Author:  [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)
#### Post date: [September 27, 2018, 11:55am UTC](https://discuss.elastic.co/t/advancing-alert-using-watcher/150048/5 "2018-09-27T11:55:13Z")
my requirement is simple, i want to show the field in body of my email how can i perform that like this,
`{{ctx.payload.hits.total}} errors have been found since {{ctx.execution_time}} UTC`
i want to show the error code("headers.httpStatusCode": "200") in the place {{ctx.payload.hits.total}}
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [September 27, 2018, 12:09pm UTC](https://discuss.elastic.co/t/advancing-alert-using-watcher/150048/6 "2018-09-27T12:09:00Z")
Check out the examples at [https://github.com/elastic/examples/tree/master/Alerting/Sample%20Watches](https://github.com/elastic/examples/tree/master/Alerting/Sample%20Watches)
you can access the hits array via `ctx.payload.hits.hits.0._source`
---
### Author:  [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)
#### Post date: [September 27, 2018, 12:17pm UTC](https://discuss.elastic.co/t/advancing-alert-using-watcher/150048/7 "2018-09-27T12:17:12Z")
but when i try that im getting this error
```
"id": "send_email",
"type": "email",
"status": "failure",
"error": {
"root_cause": [
{
"type": "general_script_exception",
"reason": "Error running com.github.mustachejava.codes.DefaultMustache@16d2a49b"
}
],
"type": "general_script_exception",
"reason": "Error running com.github.mustachejava.codes.DefaultMustache@16d2a49b",
"caused_by": {
"type": "mustache_exception",
"reason": "Failed to get value for ctx.payload.hits.hits.0._source.headers.httpStatusCode @[query-template:1]",
"caused_by": {
"type": "mustache_exception",
"reason": "0 @[query-template:1]",
"caused_by": {
"type": "index_out_of_bounds_exception",
"reason": "0"
```
---
### Author:  [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)
#### Post date: [September 27, 2018, 12:56pm UTC](https://discuss.elastic.co/t/advancing-alert-using-watcher/150048/8 "2018-09-27T12:56:31Z")
below error is resolved and i mentioned those ctx in subject instead of body
---
### Author:  [@elastock](https://discuss.elastic.co/u/elastock)
#### Post date: [September 27, 2018, 12:56pm UTC](https://discuss.elastic.co/t/advancing-alert-using-watcher/150048/9 "2018-09-27T12:56:53Z")
It's normal to get this error because the array _ctx.payload.hits.hits_ is empty because you put this in your query .
> [@Ganesh2303](#):
>
> "body": { "size": 0,
`size 0` mean 0 document accessible in the output of the query
to fix it , just set a size \>0 for example
`"size" :15`
---
### Author:  [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)
#### Post date: [September 27, 2018, 1:00pm UTC](https://discuss.elastic.co/t/advancing-alert-using-watcher/150048/10 "2018-09-27T13:00:15Z")
thank you @elastock i made that change also.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 25, 2018, 1:00pm UTC](https://discuss.elastic.co/t/advancing-alert-using-watcher/150048/11 "2018-10-25T13:00:16Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.