# Dynamic date passing in indices in watcher
**URL:** https://discuss.elastic.co/t/dynamic-date-passing-in-indices-in-watcher/66972
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [November 23, 2016, 12:15pm UTC](https://discuss.elastic.co/t/dynamic-date-passing-in-indices-in-watcher/66972 "2016-11-23T12:15:10Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@sankar](https://discuss.elastic.co/u/sankar)
#### Post date: [November 23, 2016, 12:15pm UTC](https://discuss.elastic.co/t/dynamic-date-passing-in-indices-in-watcher/66972/1 "2016-11-23T12:15:10Z")
Hi,
I am new to ELK setup, I am trying to create watcher for regular monitoring. I am unable to pass date as dynamic in watcher. Can you please help me how to fix this.
PUT \_xpack/watcher/watch/test
{
"trigger" : {
"schedule" : { "interval" : "7200s" }
},
"input" : {
"search" : {
"request" : {
"indices" : ["%3Cfilebeat-%7Bnow%2Fd%7D%3E"],
"body" : {
"query" : {
"match" : { "message": "testing" }
}
}
}
}
},
"actions" : {
"send\_email" : {
"email" : {
"to" : "",
"subject" : "Found Exceptions in logs",
"body" : "Logs are showing Exceptions",
"attach\_data" : true
}
}
}
}
Indices field is not taking the dynamic date format.,
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [November 23, 2016, 12:36pm UTC](https://discuss.elastic.co/t/dynamic-date-passing-in-indices-in-watcher/66972/2 "2016-11-23T12:36:05Z")
Hey,
have you tried not URL encoding it? The search input does not require this.
--Alex
---
### Author:  [@sankar](https://discuss.elastic.co/u/sankar)
#### Post date: [November 23, 2016, 12:39pm UTC](https://discuss.elastic.co/t/dynamic-date-passing-in-indices-in-watcher/66972/3 "2016-11-23T12:39:28Z")
Hey Alex,
I tried like this [filebeat - {now/d}], it is also not working. I tried with filebeat-\* it worked. if I use \* will it run for all days indices or not
-Sankar
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [November 23, 2016, 1:12pm UTC](https://discuss.elastic.co/t/dynamic-date-passing-in-indices-in-watcher/66972/4 "2016-11-23T13:12:37Z")
Hey,
that is the wrong syntax, you need to use the `<>` chars. See the [the dath math docs](https://www.elastic.co/guide/en/elasticsearch/reference/5.0/date-math-index-names.html)
--Alex
---
### Author:  [@sankar](https://discuss.elastic.co/u/sankar)
#### Post date: [November 23, 2016, 1:14pm UTC](https://discuss.elastic.co/t/dynamic-date-passing-in-indices-in-watcher/66972/5 "2016-11-23T13:14:51Z")
```
"indices" : <"filebeat- {now/d}>,
```
I tried like this also, no luck. If you don't mind can you give me the exact syntax
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [November 23, 2016, 1:59pm UTC](https://discuss.elastic.co/t/dynamic-date-passing-in-indices-in-watcher/66972/6 "2016-11-23T13:59:28Z")
Please sit back and take the time to read the documentation. You literally just have to copy and paste the example and replace logstash with filebeat. I cannot do much more, than pointing you to it. Your example above contains two errors, as it is invalid JSON and contains an unneeded white space.
--Alex
---
### Author:  [@sankar](https://discuss.elastic.co/u/sankar)
#### Post date: [November 23, 2016, 3:51pm UTC](https://discuss.elastic.co/t/dynamic-date-passing-in-indices-in-watcher/66972/7 "2016-11-23T15:51:53Z")
Able to figure it out! Thanks
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 21, 2016, 3:52pm UTC](https://discuss.elastic.co/t/dynamic-date-passing-in-indices-in-watcher/66972/8 "2016-12-21T15:52:06Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.