# Auditbeat notify about files changes **URL:** \ **Category:** Beats\ **Tags:** elastic-stack-alerting, auditbeat\ **Created:** [December 18, 2018, 3:17pm UTC](https://discuss.elastic.co/t/auditbeat-notify-about-files-changes/161354 "2018-12-18T15:17:53Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![HePw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hepw/32/38941_2.png) [@HePw](https://discuss.elastic.co/u/HePw)\ **Post date:** [December 18, 2018, 3:17pm UTC](https://discuss.elastic.co/t/auditbeat-notify-about-files-changes/161354/1 "2018-12-18T15:17:53Z")
Hello, can anybody show me example how to create a notification (email, slack...) when Auditbeat notice changes in files? I've elasticsearch from [elastic.co](http://elastic.co) with installed auditbeat on the server, all works fine. But I want to have notification when new file was added on the server. Thank you. ---
**Author:** ![webmat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/webmat/32/46191_2.png) [@webmat](https://discuss.elastic.co/u/webmat)\ **Post date:** [December 18, 2018, 3:38pm UTC](https://discuss.elastic.co/t/auditbeat-notify-about-files-changes/161354/2 "2018-12-18T15:38:53Z")
Hey Hubert, Your best bet is to use [Watcher](https://www.elastic.co/guide/en/elastic-stack-overview/current/xpack-alerting.html). Watcher is not specific to Auditbeat, however. With Watcher, you can define any type of query that should generate a notification, based on an Elasticsearch query or a cluster status. Then you specify your preferred notification method via the Watcher "Actions". Can be an email or a webhook, for example. Cheers Mat ---
**Author:** ![HePw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hepw/32/38941_2.png) [@HePw](https://discuss.elastic.co/u/HePw)\ **Post date:** [December 18, 2018, 3:43pm UTC](https://discuss.elastic.co/t/auditbeat-notify-about-files-changes/161354/3 "2018-12-18T15:43:26Z")
Yes, I know that I can use this tool. But how to write this scripts? Could you provide any example? I want to fetch one query every 5 minutes and if any exist, send the result via Slack/Mail. ---
**Author:** ![webmat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/webmat/32/46191_2.png) [@webmat](https://discuss.elastic.co/u/webmat)\ **Post date:** [December 18, 2018, 6:23pm UTC](https://discuss.elastic.co/t/auditbeat-notify-about-files-changes/161354/4 "2018-12-18T18:23:20Z")
There are full examples, including the full API call to create the watch, in the [Example Watches](https://www.elastic.co/guide/en/elastic-stack-overview/current/watching-meetup-data.html) section. Scroll down to "The complete watch looks like this". Then you'll need to adjust that example to target your auditbeat indices, the frequency and time ranges, and finally which output you want to use (the example actually uses email). ---
**Author:** ![webmat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/webmat/32/46191_2.png) [@webmat](https://discuss.elastic.co/u/webmat)\ **Post date:** [December 18, 2018, 6:24pm UTC](https://discuss.elastic.co/t/auditbeat-notify-about-files-changes/161354/5 "2018-12-18T18:24:52Z")
Note that all of this process lives in Elasticsearch. You don't need a script per se. The API call you see (`PUT _xpack/watcher/watch/...`) can be performed directly from Kibana, in the "Dev Tools" section. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 8, 2019, 6:24pm UTC](https://discuss.elastic.co/t/auditbeat-notify-about-files-changes/161354/6 "2019-01-08T18:24:55Z")
This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.