# Creating a Watch with Nest difficulty

**URL:** https://discuss.elastic.co/t/creating-a-watch-with-nest-difficulty/1783
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [June 2, 2015, 9:34pm UTC](https://discuss.elastic.co/t/creating-a-watch-with-nest-difficulty/1783 "2015-06-02T21:34:42Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![danielmoon](https://avatars.discourse-cdn.com/v4/letter/d/278dde/32.png) [@danielmoon](https://discuss.elastic.co/u/danielmoon)
#### Post date: [June 2, 2015, 9:34pm UTC](https://discuss.elastic.co/t/creating-a-watch-with-nest-difficulty/1783/1 "2015-06-02T21:34:42Z")

</div>

Hi, I'm having a bit of trouble getting this watch setup correctly. I know my problem is in the Input lambda, it doesn't like how I'm using the aggregation.

What I'm trying to do is find the number of times my field "sc-status" equals 500 grouped by days so I get something like:

Monday : 150  
Tuesday : 175  
Wed : 225  
Blah Blah Blah

Here's the code,(Using NEST)

```
        string query2 = "{ \"match\" : { \"sc-status\" : \"500\" } }";
        var client2 = new ElasticClient();           
        var result = client2.PutWatch("watch_name", w => w
            .ThrottlePeriod("10s")
            .Trigger(t => t
                .Schedule(s => s
                    .Cron("0 * * * * ?")))
            .Input(i => i
                .Search(se => se
                    .Request(r => r
                        .Indices("iislog")
                        .Body<object>(b => b
                            .Aggregations(a=>a
                                .DateHistogram("errors",d=>d
                                    .Interval("day")))
                                    .QueryRaw(query2)))))
            .Condition(c => c
                .GreaterThanOrEqualTo("ctx.payload.hits.total", 1000))
            .Actions(a => a
                .Add("send_email", new EmailAction
                {
                    To = "<my-email>",
                    Subject = "iislog errors",
                    Body = new Nest.EmailBody
                    {
                        Text = "At {{ctx.trigger.triggered_time}}\nThere were {{ctx.payload.hits.total}} errors in the iislogs"
                    },
                    AttachData = true,
                    Priority = Nest.EmailPriority.High
                })));

```

I've got the query working in an ElasticsearchClient like this: (Using [Elasticsearch.Net](http://Elasticsearch.Net))

```
        string query = @"{
""aggs"" : { 
    ""messages"" : { 
        ""filter"" : {
            ""bool"": {
                ""must"": [{
                    ""query"": {
                        ""match"": {
                            ""sc-status"": ""500""
                            }
                        }
                    }
                ]
            }
        },
        ""aggs"" : {
            ""errors"" : {
                ""date_histogram"" : {
                    ""field"" : ""date"",
                    ""interval"" : ""day"",
                    ""min_doc_count"" : 1
                }
            }
        }
    }
}
}";
ElasticsearchClient client = new ElasticsearchClient();
var response = client.Search("iislog", "logentry", query);

```

I definitely know it's something to do with the input lambda.  
I just can't figure out how to get it in the watch correctly.

---

<div class="post-metadata">

### Author: ![gmarz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gmarz/32/22178_2.png) [@gmarz](https://discuss.elastic.co/u/gmarz)
#### Post date: [June 3, 2015, 3:02pm UTC](https://discuss.elastic.co/t/creating-a-watch-with-nest-difficulty/1783/2 "2015-06-03T15:02:32Z")

</div>

Hey @danielmoon, what exactly is the trouble that you're having? Are you getting an error of any sort, or is the watch simply not working as you expect?

The search input in your put watch request isn't the same as the query you posted using [Elasticsearch.Net](http://Elasticsearch.Net). Also, nesting the date histogram under the filter aggregation isn't really necessary in this case. Instead, I think you want the main query to filter on `sc-status: 500`, and then you want to execute the histogram agg over those results.

Try this as your Input instead:

```auto
.Input(i => i
  .Search(s => s
    .Request(r => r
      .Body<object>(b => b
        .Query(q => q
          .Filtered(fq => fq
            .Filter(f => f
              .Term("sc-status", 500)
            )
          )
        )
	.Aggregations(aggs => aggs
          .DateHistogram("errors", dh => dh
            .Field("date")
            .Interval(DateInterval.Day)
            .MinimumDocumentCount(1)
          )
	)
      )
    )
  )
)

```

Let me know if that helps.

---

<div class="post-metadata">

### Author: ![danielmoon](https://avatars.discourse-cdn.com/v4/letter/d/278dde/32.png) [@danielmoon](https://discuss.elastic.co/u/danielmoon)
#### Post date: [June 3, 2015, 5:17pm UTC](https://discuss.elastic.co/t/creating-a-watch-with-nest-difficulty/1783/3 "2015-06-03T17:17:39Z")

</div>

Hey that worked!

To answer your question, I was getting an error trying my watch as I described above.

```
Could not find the appropriate value context to perform aggregation [errors]

```

In my testing both of the queries I wrote gave me the same result (In Sense) however, the second one had the extra "messages" bucket.

I'll post both of them for clarity:

```
POST /iislog/logentry/_search?search_type=count
{
"aggs" : { 
    "messages" : { 
        "filter" : {
            "bool": {
                "must": [{
                    "query": {
                        "match": {
                            "sc-status": "500"
                            }
                        }
                    }
                ]
            }
        },
        "aggs" : {
            "errors" : {
                "date_histogram" : {
                    "field" : "date",
                    "interval" : "day",
                    "min_doc_count" : 1
                }
            }
        }
    }
}
}

POST /iislog/logentry/_search?search_type=count
{
"aggs" : {
    "days" : {
        "date_histogram" : { 
            "field" : "date",
            "interval" : "day"
        }
    }
},
"query": {
    "match": {
       "sc-status": "500"
    }
}
}
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:49pm UTC](https://discuss.elastic.co/t/creating-a-watch-with-nest-difficulty/1783/4 "2017-07-06T13:49:42Z")

</div>