# Alert configuration using watcher
**URL:** https://discuss.elastic.co/t/alert-configuration-using-watcher/181036
**Category:** Elasticsearch
**Created:** [May 14, 2019, 4:11pm UTC](https://discuss.elastic.co/t/alert-configuration-using-watcher/181036 "2019-05-14T16:11:47Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Dhana](https://discuss.elastic.co/u/Dhana)
#### Post date: [May 14, 2019, 4:11pm UTC](https://discuss.elastic.co/t/alert-configuration-using-watcher/181036/1 "2019-05-14T16:11:48Z")
Hi, we have Version: 6.5.4 running, we would like to configure alerts using "watcher" based on the events that we are getting on the logs.
We have several Fields on the CLS and we would like to trigger an alert when I see the message "Crashed" on the "\_source" field.
{
"trigger": {
"schedule": {
"interval": "5m"
}
},
"input": {
"search": {
"request": {
"search\_type": "query\_then\_fetch",
"indices": [
"logs-pcf-firehose-_"
],
"types": [],
"body": {
"query": {
"bool": {
"must": [
{
"match": {
"clsapplication": "_"
}
}
]
}
}
}
}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gt": 0
}
}
},
"actions": {
"email\_admin": {
"email": {
"profile": "standard",
"to": [
"test@email.com"
],
"subject": "Test Alert"
}
}
}
}
could you please provide us the code to configure it.
Thanks,
Dhana
---
### Author:  [@Dhana](https://discuss.elastic.co/u/Dhana)
#### Post date: [May 14, 2019, 4:56pm UTC](https://discuss.elastic.co/t/alert-configuration-using-watcher/181036/2 "2019-05-14T16:56:30Z")
We have the "Crashed" message part of the msg filed on the cls,
example-
aused by: java.sql.SQLException: ORA-01652: unable to extend Crashed temp segment by 128 in tablespace
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 11, 2019, 4:56pm UTC](https://discuss.elastic.co/t/alert-configuration-using-watcher/181036/3 "2019-06-11T16:56:38Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.