# Can Watcher do this (Dynamic threshold)

**URL:** <https://discuss.elastic.co/t/can-watcher-do-this-dynamic-threshold/168416>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [February 14, 2019, 12:48pm UTC](https://discuss.elastic.co/t/can-watcher-do-this-dynamic-threshold/168416 "2019-02-14T12:48:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![MalfuncEddie](https://avatars.discourse-cdn.com/v4/letter/m/3da27b/32.png) [@MalfuncEddie](https://discuss.elastic.co/u/MalfuncEddie)\
**Post date:** [February 14, 2019, 12:48pm UTC](https://discuss.elastic.co/t/can-watcher-do-this-dynamic-threshold/168416/1 "2019-02-14T12:48:03Z")

</div>

Hi,

I'm looking to use a watcher that does the following:  
Compare the error/succes rate of the last 5 minutes to the last 10 minutes. if there is a drop or spike an action is fired. (based on [https://www.elastic.co/videos/watcher-lab-creating-alerts-with-dynamic-threshold](https://www.elastic.co/videos/watcher-lab-creating-alerts-with-dynamic-threshold))

I've got an index that is populated with Apache logs.  
I want to know if the percentage of 4xx response codes spikes during the day.  
Does anyone have an example that can get me started? The video puts me on the right track but I am stuck.

Any help would be appreciated

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [February 15, 2019, 9:00am UTC](https://discuss.elastic.co/t/can-watcher-do-this-dynamic-threshold/168416/2 "2019-02-15T09:00:56Z")

</div>

The most important thing is to get the two aggregations right. The shard video contains those aggregations/sample queries. Is there any issue with those with your dataset that you cannot reuse them? Maybe you share your example based on that and we work from there?

--Alex

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 15, 2019, 9:01am UTC](https://discuss.elastic.co/t/can-watcher-do-this-dynamic-threshold/168416/3 "2019-03-15T09:01:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.