# Creating watch for kibana to get only warning

**URL:** <https://discuss.elastic.co/t/creating-watch-for-kibana-to-get-only-warning/255675>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting\
**Created:** [November 17, 2020, 11:23am UTC](https://discuss.elastic.co/t/creating-watch-for-kibana-to-get-only-warning/255675 "2020-11-17T11:23:35Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Lokesh\_Mayan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lokesh_mayan/32/78641_2.png) [@Lokesh\_Mayan](https://discuss.elastic.co/u/Lokesh_Mayan)\
**Post date:** [November 17, 2020, 11:23am UTC](https://discuss.elastic.co/t/creating-watch-for-kibana-to-get-only-warning/255675/1 "2020-11-17T11:23:35Z")

</div>

![image](https://us1.discourse-cdn.com/elastic/original/3X/2/b/2bfaa2a8af47f25f54a2693611440941d725326c.png)

I am creating a script in watch to get an alert if my warning count increases more than five. in the image you can see that i get the count alert of all the data in the field (event \_type) has been exceeded more than 5 and i get the alert through slack. Here my requirement is out of Info , finest and warning data, i want only the warning data to be triggered and displayed in the alert. is there anychanges to be made in the script?

---

<div class="post-metadata">

**Author:** ![AClerk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aclerk/32/55297_2.png) [@AClerk](https://discuss.elastic.co/u/AClerk)\
**Post date:** [November 18, 2020, 3:50am UTC](https://discuss.elastic.co/t/creating-watch-for-kibana-to-get-only-warning/255675/2 "2020-11-18T03:50:50Z")

</div>

you need to add your query a condition to match warning only.  
Something like this

```auto
  "query": {
    "term": {
      "status.keyword": {
        "value": "warning"
      }
    }
  }

```

Reference - [https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-term-query.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-term-query.html)

---

<div class="post-metadata">

**Author:** ![Lokesh\_Mayan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lokesh_mayan/32/78641_2.png) [@Lokesh\_Mayan](https://discuss.elastic.co/u/Lokesh_Mayan)\
**Post date:** [November 18, 2020, 11:10am UTC](https://discuss.elastic.co/t/creating-watch-for-kibana-to-get-only-warning/255675/3 "2020-11-18T11:10:06Z")

</div>

Yes its working now. Thank you so much @AClerk 😊

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 16, 2020, 11:10am UTC](https://discuss.elastic.co/t/creating-watch-for-kibana-to-get-only-warning/255675/4 "2020-12-16T11:10:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.