# Conditional watcher alert

**URL:** <https://discuss.elastic.co/t/conditional-watcher-alert/240210>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [July 7, 2020, 7:09pm UTC](https://discuss.elastic.co/t/conditional-watcher-alert/240210 "2020-07-07T19:09:33Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![velu](https://avatars.discourse-cdn.com/v4/letter/v/6a8cbe/32.png) [@velu](https://discuss.elastic.co/u/velu)\
**Post date:** [July 7, 2020, 7:09pm UTC](https://discuss.elastic.co/t/conditional-watcher-alert/240210/1 "2020-07-07T19:09:33Z")

</div>

Hi,

Is it possible to set the alert triggering condition like ...the alert should trigger after 10 mins after it reaches threshold value .

Note: we have to wait for 10 mins to check whether the value is getting drained or not

Thanks,  
Velu G

---

<div class="post-metadata">

**Author:** ![velu](https://avatars.discourse-cdn.com/v4/letter/v/6a8cbe/32.png) [@velu](https://discuss.elastic.co/u/velu)\
**Post date:** [July 8, 2020, 1:16pm UTC](https://discuss.elastic.co/t/conditional-watcher-alert/240210/2 "2020-07-08T13:16:10Z")

</div>

Hi ,

Can someone please assist for my above concern.

Thanks,  
Velu G

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [July 23, 2020, 9:27am UTC](https://discuss.elastic.co/t/conditional-watcher-alert/240210/3 "2020-07-23T09:27:36Z")

</div>

can you explain the setup a bit more, to make sure folks are not missing things. How about checking the values from 10 minutes ago, and this way it should work? Is there more to that is hidden between the lines?

---

<div class="post-metadata">

**Author:** ![velu](https://avatars.discourse-cdn.com/v4/letter/v/6a8cbe/32.png) [@velu](https://discuss.elastic.co/u/velu)\
**Post date:** [July 23, 2020, 5:23pm UTC](https://discuss.elastic.co/t/conditional-watcher-alert/240210/4 "2020-07-23T17:23:03Z")

</div>

Hi,

Please find the details below...Currently my watcher will trigger the alert whenever the threshold reaches(14) . Instead of this i want to set the conditional alert like the alert need to trigger when my threshold breaches more than or equal to 10 mins.

{  
"trigger": {  
"schedule": {  
"hourly": {  
"minute": [  
0,  
10,  
20,  
30,  
40,  
50  
]  
}  
}  
},  
"input": {  
"search": {  
"request": {  
"search\_type": "query\_then\_fetch",  
"indices": [  
"eastern-mjsqueue-\*"  
],  
"types": ,  
"body": {  
"query": {  
"bool": {  
"must": [  
{  
"match\_all": {}  
},  
{  
"range": {  
"@timestamp": {  
"gte": "now-{{ctx.metadata.range\_date\_time}}"  
}  
}  
},  
{  
"match\_phrase": {  
"fields.eastern\_region": {  
"query": "{{ctx.metadata.region}}"  
}  
}  
},  
{  
"match\_phrase": {  
"jsondoc.mjsdestname.keyword": {  
"query": "easternInboundQueue"  
}  
}  
},  
{  
"range": {  
"jsondoc.messagecurrentCount": {  
"gt": "{{ctx.metadata.threshold}}"  
}  
}  
}  
]  
}  
},  
"aggs": {  
"region": {  
"terms": {  
"field": "fields.eastern\_region.keyword",  
"size": 5,  
"order": {  
"\_term": "desc"  
}  
},  
"aggs": {  
"perc": {  
"percentiles": {  
"field": "jsondoc.messagecurrentCount",  
"percents": [  
90  
],  
"keyed": false  
}  
},  
"currentcount": {  
"max": {  
"field": "jsondoc.messagecurrentCount"  
}  
}  
}  
}  
}  
}  
}  
}  
},  
"condition": {  
"compare": {  
"ctx.payload.hits.total": {  
"gt": 0  
}  
}  
},

"metadata": {  
"watcher\_id": "mjsQ-0001",  
"range\_date\_time": "10m",  
"slack": true,  
"threshold": 14,  
"region": "east-on",  
"watcher\_name": "Alert for eastern mjs Inbound Queue Depth by Percentiles",  
"email": true  
}  
}

Please suggest me how to proceed the conditional alert.

Note: I don't want the alert immediately when it reaches to the threshold 14 .

Thanks,  
Velu G

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [July 29, 2020, 2:18pm UTC](https://discuss.elastic.co/t/conditional-watcher-alert/240210/5 "2020-07-29T14:18:17Z")

</div>

Hey,

Before thinking in terms of a watch, start thinking in terms of a search query. Can I create a search query that provides me the relevant information. My assumption in this case is, that you may only want to trigger an action, if the threshold is above the configured one in several consecutive runs. So, how can you write a query like this? Probably by using aggregations, by using a date histogram to divide your data into time buckets, then retrieving the `max` value for each bucket and then checking if all of the last n buckets are above your threshold?

Does that sound like a plan? If so, taking a look at the date histogram and the max aggregations might make sense.

Hope that helps to get started

--Alex

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 26, 2020, 2:18pm UTC](https://discuss.elastic.co/t/conditional-watcher-alert/240210/6 "2020-08-26T14:18:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.