# Creating Watcher from Request Data in Kibana

**URL:** <https://discuss.elastic.co/t/creating-watcher-from-request-data-in-kibana/118743>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting\
**Created:** [February 7, 2018, 3:10am UTC](https://discuss.elastic.co/t/creating-watcher-from-request-data-in-kibana/118743 "2018-02-07T03:10:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![thelonestargeek](https://avatars.discourse-cdn.com/v4/letter/t/77aa72/32.png) [@thelonestargeek](https://discuss.elastic.co/u/thelonestargeek)\
**Post date:** [February 7, 2018, 3:10am UTC](https://discuss.elastic.co/t/creating-watcher-from-request-data-in-kibana/118743/1 "2018-02-07T03:10:24Z")

</div>

Is there a way to use the "Request" JSON from the "Discover" section of kibana and turn it into a watcher? I'm having an issue figuring how to do an "OR" in a watcher, but I have the JSON.

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [February 9, 2018, 3:10pm UTC](https://discuss.elastic.co/t/creating-watcher-from-request-data-in-kibana/118743/2 "2018-02-09T15:10:30Z")

</div>

Hey,

no, you need to create watches manually and the query is only a very small part. What you need to do is to use a `query_string` query in Elasticsearch and put your query in there. This resembles what you type into the kibana search input at the top.

If you have problems coming up with a watch, please provide more infos, so we can get there step by step.

--Alex

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 11, 2018, 3:10pm UTC](https://discuss.elastic.co/t/creating-watcher-from-request-data-in-kibana/118743/3 "2018-03-11T15:10:31Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.
