# Create Kibana Watcher alerts for certain conditions

**URL:** <https://discuss.elastic.co/t/create-kibana-watcher-alerts-for-certain-conditions/226275>\
**Category:** Kibana\
**Created:** [April 2, 2020, 7:17pm UTC](https://discuss.elastic.co/t/create-kibana-watcher-alerts-for-certain-conditions/226275 "2020-04-02T19:17:42Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![malleable](https://avatars.discourse-cdn.com/v4/letter/m/a5b964/32.png) [@malleable](https://discuss.elastic.co/u/malleable)\
**Post date:** [April 2, 2020, 7:17pm UTC](https://discuss.elastic.co/t/create-kibana-watcher-alerts-for-certain-conditions/226275/1 "2020-04-02T19:17:42Z")

</div>

Hi all, I am trying to achieve the following with my Kibana watcher.

1\> I have added logs in my code with the text "Security Alert" where there is an appropriate security violation. So, in my code, in certain sections, I have done the following:  
logger.log("Security Alert: More info about it");  
2\> My end goal is to be able to capture and send alerts where there are say 10 of these Security Alerts in the log in a span of 30 minutes.

I have written a watcher json below. I can see the text getRecentOrders in the Kibana search window but it's not logging through the watcher. Any idea what I am doing wrong? Also, how can I capture the 10 times within the 30 minutes criteria?

```auto
{
  "trigger": {
    "schedule": {
      "interval": "30m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "must": [
                {
                  "query_string": {
                    "match": "getRecentOrders"
                  }
                },
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-30m"
                    }
                  }
                }
              ]
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gte": 10
      }
    }
  },
  "actions": {
    "my-logging-action": {
      "logging": {
        "level": "info",
        "text": "There are {{ctx.payload.hits.total}} documents in your index. Threshold is 10."
      }
    }
  }
}

```

Any help would be appreciated.

---

<div class="post-metadata">

**Author:** ![matw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matw/32/13913_2.png) [@matw](https://discuss.elastic.co/u/matw)\
**Post date:** [April 3, 2020, 10:15am UTC](https://discuss.elastic.co/t/create-kibana-watcher-alerts-for-certain-conditions/226275/2 "2020-04-03T10:15:18Z")

</div>

Hi and welcome to our community

Could you replace  
`"match": "getRecentOrders"`  
with  
`"query": "getRecentOrders"`

did you try to simulate your watcher?

Best,  
Matthias

---

<div class="post-metadata">

**Author:** ![malleable](https://avatars.discourse-cdn.com/v4/letter/m/a5b964/32.png) [@malleable](https://discuss.elastic.co/u/malleable)\
**Post date:** [April 3, 2020, 1:28pm UTC](https://discuss.elastic.co/t/create-kibana-watcher-alerts-for-certain-conditions/226275/3 "2020-04-03T13:28:03Z")

</div>

I had tried the query initially, it didn't work then I tried match. In any case, I tried query now, doesn't seem to work. How do I simulate the watcher?

---

<div class="post-metadata">

**Author:** ![matw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matw/32/13913_2.png) [@matw](https://discuss.elastic.co/u/matw)\
**Post date:** [April 3, 2020, 4:51pm UTC](https://discuss.elastic.co/t/create-kibana-watcher-alerts-for-certain-conditions/226275/4 "2020-04-03T16:51:00Z")

</div>

Which version of Kibana do you use, I've used the latest, here's the edit screen of a watcher:

 ![Bildschirmfoto 2020-04-03 um 18.37.48](https://us1.discourse-cdn.com/elastic/original/3X/3/d/3db496fbe2af6e6dfafccb7cf50ba84dd4256be0.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 1, 2020, 4:51pm UTC](https://discuss.elastic.co/t/create-kibana-watcher-alerts-for-certain-conditions/226275/5 "2020-05-01T16:51:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.