# Delay watcher trigger time | Heartbeat
**URL:** https://discuss.elastic.co/t/delay-watcher-trigger-time-heartbeat/149996
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [September 26, 2018, 11:57am UTC](https://discuss.elastic.co/t/delay-watcher-trigger-time-heartbeat/149996 "2018-09-26T11:57:41Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@max17](https://discuss.elastic.co/u/max17)
#### Post date: [September 26, 2018, 11:57am UTC](https://discuss.elastic.co/t/delay-watcher-trigger-time-heartbeat/149996/1 "2018-09-26T11:57:41Z")
Team, I have created a heartbeat watcher which is working fine, whenever a website goes down, it triggers an alert for it, but my query is, I have multiple website hosted in same server i.e 3 sites. Sometime 1 website take delay in loading and watcher assumes the website as "DOWN" and trigger the alert which offcourse is false alert as there is just delay of 10-15 sec for the website to load.
My question is, is there any way to delay the trigger of watcher, as it check the website performance for 10-15 sec and then trigger the alert, instead of just throwing the email alert that the site is down,
Below is the watcher which I configured, please have a look at it and please let me know what am I doing wrong.
```
{
"trigger": {
"schedule": {
"interval": "10s"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"heartbeat-wp-xyz-*"
],
"types": [],
"body": {
"size": 0,
"query": {
"bool": {
"must": [
{
"term": {
"monitor.status": {
"value": "down"
}
}
}
],
"filter": [
{
"range": {
"@timestamp": {
"from": "now-10s"
}
}
}
]
}
},
"aggregations": {
"by_monitors": {
"terms": {
"field": "monitor.id",
"size": 100,
"min_doc_count": 1
}
}
}
}
}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gt": 0
}
}
},
"actions": {
"email_1": {
"email": {
"account": "gmail_account",
"profile": "gmail",
"to": [
"abc@xyz.com"
],
"subject": "Alert! SERVER IS DOWN !!",
"body": {
"html": "{{ctx.payload.hits.total}} Server has stopped working:
{{#ctx.payload.aggregations.by_monitors.buckets}}{{key}}
{{/ctx.payload.aggregations.by_monitors.buckets}} \t \n\n at times:
{{ctx.trigger.triggered_time}} \n\n"
}
}
}
}
}
```
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [September 26, 2018, 2:41pm UTC](https://discuss.elastic.co/t/delay-watcher-trigger-time-heartbeat/149996/2 "2018-09-26T14:41:46Z")
hey,
how about having more than one aggregation that also checks for the previous status (by having an aggregation bucket for `now-10s` and one for `now-1m` and only alert if a host is in both buckets?
--Alex
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 24, 2018, 2:41pm UTC](https://discuss.elastic.co/t/delay-watcher-trigger-time-heartbeat/149996/3 "2018-10-24T14:41:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.