# Balancing Watcher execution times

**URL:** <https://discuss.elastic.co/t/balancing-watcher-execution-times/79786>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [March 23, 2017, 5:35pm UTC](https://discuss.elastic.co/t/balancing-watcher-execution-times/79786 "2017-03-23T17:35:56Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ryan\_Grannell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ryan_grannell/32/41712_2.png) [@Ryan\_Grannell](https://discuss.elastic.co/u/Ryan_Grannell)\
**Post date:** [March 23, 2017, 5:35pm UTC](https://discuss.elastic.co/t/balancing-watcher-execution-times/79786/1 "2017-03-23T17:35:56Z")

</div>

Hi,

Most of our Watchers execute on a 15 minute interval. We have about 50 watches, so ideally these should execute at "balanced" times; 50 Watchers should not execute simultaneously at `00:00, 00:15, ...` for example.

Does `interval: 15m` this mean that:

- Each Watcher runs at `00:00, 00:15, 00:30, ..., 23:45`. In cron-speak, `*/15 * * * *`
- Or, that they run at multiples of fifteen minutes after the watcher was created (e.g `00:17, 00:33, ...`)?

If they run at `*/15 * * * *`, is there any built-in way to spread the Watcher execution time out. equivalent to the Jenkins syntax `H/15 * * * *`?

Regards,  
Ryan

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [March 27, 2017, 8:19am UTC](https://discuss.elastic.co/t/balancing-watcher-execution-times/79786/2 "2017-03-27T08:19:46Z")

</div>

Hey Ryan,

the `interval` schedule does not give any guarantees that watch executions will be distributed, especially after a master node switch or a cluster restart (where the interval will be used, to potentially run all watches next to each other).

You could use the `hourly` schedule likes this and distribute the watches

```auto
"hourly" : { "minute" : [0, 15, 30, 45] }

```

or just use a cron expression as you mentioned. You can use the `bin/watcher/croneval` tool to make sure your cron expression can be parsed correctly by watcher.

--Alex

---

<div class="post-metadata">

**Author:** ![Ryan\_Grannell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ryan_grannell/32/41712_2.png) [@Ryan\_Grannell](https://discuss.elastic.co/u/Ryan_Grannell)\
**Post date:** [March 28, 2017, 9:18am UTC](https://discuss.elastic.co/t/balancing-watcher-execution-times/79786/3 "2017-03-28T09:18:10Z")

</div>

Hi Alex,

I think your suggestion of using the `hourly` schedule to distribute watchers is a sensible workaround; I can force them to be distributed evenly when I'm generating each watcher (thankfully I do this programmatically). e.g for three watchers

```
# a.
"hourly" : { "minute" : [0, 15, 30, 45] }
# b.
"hourly" : { "minute" : [5, 20, 35, 50] }
# c.
"hourly" : { "minute" : [10, 25, 40, 55] }

```

Thanks (as always),  
Ryan

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 25, 2017, 9:18am UTC](https://discuss.elastic.co/t/balancing-watcher-execution-times/79786/4 "2017-04-25T09:18:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.