# Count with logstash
**URL:** https://discuss.elastic.co/t/count-with-logstash/105862
**Category:** Logstash
**Created:** [October 31, 2017, 9:55am UTC](https://discuss.elastic.co/t/count-with-logstash/105862 "2017-10-31T09:55:21Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@citanionarrei](https://discuss.elastic.co/u/citanionarrei)
#### Post date: [October 31, 2017, 9:55am UTC](https://discuss.elastic.co/t/count-with-logstash/105862/1 "2017-10-31T09:55:21Z")
Hi friends
i'm using elk suite to analize log file
My logs contain in any row a json file that with grok i can correctly extract it..
Now, i want count the occurrences
to try, i want count a simple word (for example "debug") an after this i want generate an alert when "debug" is present more of 10 time in my document...
I have installed and configurated correctly email plugin for alert, and i have installed metric plugin..
Can you help me.
Sorry for my english
E.A.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 31, 2017, 10:08am UTC](https://discuss.elastic.co/t/count-with-logstash/105862/2 "2017-10-31T10:08:29Z")
Logstash is the wrong place to do this. Have a look at Elastic's own Watcher product or the third-party ElastAlert produc.t
---
### Author:  [@citanionarrei](https://discuss.elastic.co/u/citanionarrei)
#### Post date: [October 31, 2017, 12:14pm UTC](https://discuss.elastic.co/t/count-with-logstash/105862/3 "2017-10-31T12:14:34Z")
I want generate automatic alert using elk...is possible?
I prefer dont use third part'product
Where are Watcher products?
Maybe i can run it on kibana dev tool?
Scuse me for my inexperience, but i'm starting now to use elk stack...
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 31, 2017, 12:46pm UTC](https://discuss.elastic.co/t/count-with-logstash/105862/4 "2017-10-31T12:46:57Z")
See [https://www.elastic.co/guide/en/x-pack/current/xpack-alerting.html](https://www.elastic.co/guide/en/x-pack/current/xpack-alerting.html).
---
### Author:  [@citanionarrei](https://discuss.elastic.co/u/citanionarrei)
#### Post date: [October 31, 2017, 12:59pm UTC](https://discuss.elastic.co/t/count-with-logstash/105862/5 "2017-10-31T12:59:31Z")
Yes im installing now x-pack on kibana...
If i have problem can i rewrite on this post?
---
### Author:  [@citanionarrei](https://discuss.elastic.co/u/citanionarrei)
#### Post date: [October 31, 2017, 1:54pm UTC](https://discuss.elastic.co/t/count-with-logstash/105862/6 "2017-10-31T13:54:09Z")
Ok than...i have installed xpack on kibana and elastisearch...
i want thest this example
```
PUT _xpack/watcher/watch/log_error_watch
{
"trigger" : {
"schedule" : { "interval" : "10s" }
},
"input" : {
"search" : {
"request" : {
"indices" : ["logs"],
"body" : {
"query" : {
"match" : { "message": "error" }
}
}
}
}
}
}
```
where i run this "PUT \_xpack/watcher/watch/log\_error\_watch"
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 31, 2017, 2:09pm UTC](https://discuss.elastic.co/t/count-with-logstash/105862/7 "2017-10-31T14:09:00Z")
> If i have problem can i rewrite on this post?
There's a separate group for X-Pack questions.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 28, 2017, 2:17pm UTC](https://discuss.elastic.co/t/count-with-logstash/105862/8 "2017-11-28T14:17:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.