# Alerting based on particular keyword fields

**URL:** <https://discuss.elastic.co/t/alerting-based-on-particular-keyword-fields/221250>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [February 27, 2020, 1:56pm UTC](https://discuss.elastic.co/t/alerting-based-on-particular-keyword-fields/221250 "2020-02-27T13:56:25Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![saif3r](https://avatars.discourse-cdn.com/v4/letter/s/49beb7/32.png) [@saif3r](https://discuss.elastic.co/u/saif3r)\
**Post date:** [February 27, 2020, 1:56pm UTC](https://discuss.elastic.co/t/alerting-based-on-particular-keyword-fields/221250/1 "2020-02-27T13:56:26Z")

</div>

Hello,

I have a question about Watcher functionality. My **index** contains a field named **type** and **subtype**. We have around 300 different **types** , each having around 10 **subtypes**. Each event that comes to elastic contains both of those fields. We would like to setup a watcher which will check every 5 minutes, if any combination of **type/subtype** exceeds 10 documents count. If that's the case, then it will send a email notification containing **type** and **subtype** information along with number of documents. If possible, it should contain those documents in email body, or at least several field from those documents.

Is above possible? If so, is it complicated to define such Watcher?

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [March 12, 2020, 10:15am UTC](https://discuss.elastic.co/t/alerting-based-on-particular-keyword-fields/221250/2 "2020-03-12T10:15:23Z")

</div>

Hey,

you could aggregate on type/subtype using a `terms` aggregation with a `min_doc_count` of `10` and see if that is working for you.

--Alex

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 9, 2020, 10:16am UTC](https://discuss.elastic.co/t/alerting-based-on-particular-keyword-fields/221250/3 "2020-04-09T10:16:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.