# Can watcher run a local script as an Action?

**URL:** https://discuss.elastic.co/t/can-watcher-run-a-local-script-as-an-action/38239
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [January 1, 2016, 6:59am UTC](https://discuss.elastic.co/t/can-watcher-run-a-local-script-as-an-action/38239 "2016-01-01T06:59:48Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![sthurlow](https://avatars.discourse-cdn.com/v4/letter/s/e9bcb4/32.png) [@sthurlow](https://discuss.elastic.co/u/sthurlow)
#### Post date: [January 1, 2016, 6:59am UTC](https://discuss.elastic.co/t/can-watcher-run-a-local-script-as-an-action/38239/1 "2016-01-01T06:59:48Z")

</div>

I have salt running on the same host as Watcher. I have setup a watch for a specific log entry, and am currently emailing when they occur. I want to run a salt command when this log entry appears, which will interact with a Windows server and restart a service. The Watcher element is triggering, and the salt command line element works, but how do I glue them together? I

---

<div class="post-metadata">

### Author: ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [January 4, 2016, 8:33am UTC](https://discuss.elastic.co/t/can-watcher-run-a-local-script-as-an-action/38239/2 "2016-01-04T08:33:59Z")

</div>

Hey,

as Elasticsearch uses the java security manager to actually lock down what it is allowed to be executed by the JVM (as well as further security features like seccomp, which prevents forking processes).

What you could do however is using the [logstash exec output](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-exec.html) in combination with the [http input](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-http.html):

```auto
input {
  http {
    host => "127.0.0.1"
    port => 1234
  }
}

output {
  stdout {
    codec => rubydebug
  }
  exec {
    command => "iptables -A INPUT -s %{message} -j DROP"
  }
}

```

And have a watch sending data to the logstash input

```auto
PUT _watcher/watch/logstash_event_watch
{
  "trigger": {
    "schedule": {
      "interval": "10s"
    }
  },
  "input": {
    "search": {
      "request": {
        "indices": "test-index",
        "body": {
          "query": {
            "match_all": {}
          }
        }
      }
    }
  },
  "actions": {
    "logstash_exec": {
      "webhook": {
        "method": "POST",
        "host": "localhost",
        "port": 1234,
        "path": "/{{watch_id}}",
        "body": "{{ctx.payload.hits.hits[0].clientip}}"
      }
    }
  }
}

```

Note: **Written on top of my head, so may require refinement!** Needs validation, that the hits array is not empty etc...

--Alex

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:47pm UTC](https://discuss.elastic.co/t/can-watcher-run-a-local-script-as-an-action/38239/3 "2017-07-06T13:47:27Z")

</div>