# Compile Error When Watcher Defination

**URL:** <https://discuss.elastic.co/t/compile-error-when-watcher-defination/371782>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting\
**Created:** [December 10, 2024, 6:31pm UTC](https://discuss.elastic.co/t/compile-error-when-watcher-defination/371782 "2024-12-10T18:31:59Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mevlut\_Soner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mevlut_soner/32/139890_2.png) [@Mevlut\_Soner](https://discuss.elastic.co/u/Mevlut_Soner)\
**Post date:** [December 10, 2024, 6:31pm UTC](https://discuss.elastic.co/t/compile-error-when-watcher-defination/371782/1 "2024-12-10T18:31:59Z")

</div>

Hello,  
When i want to create below watcher definition, i get compile error. Is there any idea why i get compile error and how can i fix it ?

```auto
{
  "trigger": {
    "schedule": {
      "interval": "10m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "mfp.application-log*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "must": [
                {
                  "term": {
                    "service.keyword": {
                      "value": "RL1C971D"
                    }
                  }
                },
                {
                  "term": {
                    "level.keyword": {
                      "value": "ERROR"
                    }
                  }
                },
                {
                  "range": {
                    "timestamp": {
                      "gt": "now-60m"
                    }
                  }
                }
              ],
              "boost": 1
            }
          },
          "aggs": {}
        }
      }
    }
  },
  "condition": {
    "script": {
      "source": "def previousState = ctx.metadata.previous_state ?: 'normal'; def currentTotal = ctx.payload.hits.total; if (currentTotal >= 10 && previousState == 'normal'){ctx.metadata.previous_state = 'critical'; return 'critical';} else if (currentTotal < 10 && previousState == 'critical') { ctx.metadata.previous_state = 'normal'; return 'normal'; } else { return 'none';}"
    }
  },
  "actions": {
    "my_webhook": {
      "condition":{
        "script":{
          "source": "ctx.payload.result == 'critical'"
        }
      },
      "webhook": {
        "scheme": "http",
        "host": "x",
        "port": 3,
        "method": "post",
        "path": "demo.com",
        "params": {},
        "headers": {
          "Content-Type": "application/x-www-form-urlencoded"
        },
        "body": "<BSMConnectorEvent><alertname>demoAlarm</alertname><domain>demo</domain><severity>Major</severity><relatedCI>demo</relatedCI><alertdetails> mail ile bilgi verilmelidir. Match count: {{ctx.payload.hits.total}}</alertdetails></BSMConnectorEvent>"
      }
    },
    "my_webhook2":{
      "condition":{
        "script":{
          "source": "ctx.payload.result == 'normal'"
        }
      },
       "webhook": {
        "scheme": "http",
        "host": "demo.com",
        "port": 3,
        "method": "post",
        "path": "x",
        "params": {},
        "headers": {
          "Content-Type": "application/x-www-form-urlencoded"
        },
        "body": "<BSMConnectorEvent><alertname>demo Alarm</alertname><domain>OC</domain><severity>Clear</severity><relatedCI>Kullandırım Değerlendirme İşlemleri Erişilebilirlik KPI</relatedCI><alertdetails>bilgi verilmelidir. Match count: {{ctx.payload.hits.total}}</alertdetails></BSMConnectorEvent>"
      }
    }
  }
}

```

Thanks

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [December 10, 2024, 8:10pm UTC](https://discuss.elastic.co/t/compile-error-when-watcher-defination/371782/2 "2024-12-10T20:10:26Z")

</div>

the [script in the condition](https://www.elastic.co/guide/en/elasticsearch/reference/current/condition-script.html) must return a boolean `true` or `false`. It cannot return arbitrary values like `normal` or `critical`

---

<div class="post-metadata">

**Author:** ![Mevlut\_Soner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mevlut_soner/32/139890_2.png) [@Mevlut\_Soner](https://discuss.elastic.co/u/Mevlut_Soner)\
**Post date:** [December 10, 2024, 8:38pm UTC](https://discuss.elastic.co/t/compile-error-when-watcher-defination/371782/3 "2024-12-10T20:38:54Z")

</div>

thank you.. you are right. It is solved. So can i ask one more thing that is important for me, i want to check if alert or normal condition is met. So i need to transfer a value from previous state to current state. what i mean that watcher running and State=Critical. I want to check this value in second running but i can't transfer. Why i want this, because i want to check alert state if threshold is met critical alert post otherwise clear alert post

---

<div class="post-metadata">

**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\
**Post date:** [December 11, 2024, 7:50pm UTC](https://discuss.elastic.co/t/compile-error-when-watcher-defination/371782/4 "2024-12-11T19:50:16Z")

</div>

If by "previous" state you mean the state of the situation the last time the watcher ran - then you must persist that knowledge somewhere outside of the Watch (as the Watch only has information about the current execution and any past execution is not "known"). So, you could:

1. In the `action` section of the watch, in addition to doing a webhook call for the alert, also have a watcher [index action](https://www.elastic.co/guide/en/elasticsearch/reference/current/actions-index.html) to write the current state to an index, perhaps named `mfp.alert-states`
2. Then, in the `input` section, you're going to actually have the watch create two different queries, via an [input chain](https://www.elastic.co/guide/en/elasticsearch/reference/current/input-chain.html) a) the query that you already have to the `mfp.application-log*` index looking for the data, but also b) a query to your alert state index (`mfp.alert-states` or whatever you call it)
3. Then your `condition` can check the outputs of the two queries above and make a decision about alerting and updating the state index.

I don't have a full example, but I do have an example of an input chain that makes 3 separate queries and combines their results in a `condition`. Check it out [here](https://gist.github.com/richcollier/13e245c1c8c8cfc38ecb12e324ce301e)