# Dynamic watcher/alerting... without creating 100+ watchers

**URL:** <https://discuss.elastic.co/t/dynamic-watcher-alerting-without-creating-100-watchers/356408>\
**Category:** Kibana\
**Created:** [March 28, 2024, 3:36pm UTC](https://discuss.elastic.co/t/dynamic-watcher-alerting-without-creating-100-watchers/356408 "2024-03-28T15:36:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![eStrux-MAB](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/estrux-mab/32/132834_2.png) [@eStrux-MAB](https://discuss.elastic.co/u/eStrux-MAB)\
**Post date:** [March 28, 2024, 3:36pm UTC](https://discuss.elastic.co/t/dynamic-watcher-alerting-without-creating-100-watchers/356408/1 "2024-03-28T15:36:57Z")

</div>

Here's one for the "is this possible?" category.

**Is it possible to alert on specific conditions and aggregations of data within one index, without having to create an enormous number of watchers?**

Consider this: I have an index with `customer_name` and `usage` as fields. I want to alert on when usage exceeds 80 for any given customer. I want to then throttle the alert but _for that one customer only_ so that I can still intercept usage alerts for other customers.

In other words, a typical scenario would go like this:

1. Acme Inc.'s usage goes above 80. An email is sent to the operator. The alert is then throttled for a day to let the operator deal with the situation.
2. A couple of hours later, Northwind Traders' usage also goes above 80. An email is sent to the operator. The alert is then throttled for a day to let the operator deal with the situation.

Technically I could get this done by creating a watcher for every single customer in the index, but we can all agree making 100+ watchers by hand is no fun, let alone maintaining those for when customers join or leave.

I _think_ there was a way to generate automatic watchers based on machine learning or anomaly detection but I'm not certain my use case fits... In my case, I'm not looking for outliers, but rather for values that go above a precise threshold, so it's not like there's any actual ML going on here.

Any clues? 🤔

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [March 30, 2024, 4:52pm UTC](https://discuss.elastic.co/t/dynamic-watcher-alerting-without-creating-100-watchers/356408/2 "2024-03-30T16:52:31Z")

</div>

Hi @eStrux-MAB

What Version Stack are you on? This is most important.

Depending on that answer, There may be a couple of approaches

In newer versions, Alerts support Group By your Keyword.., within a single alert, that would be the most straightforward.

And of course if you are on a really new Version ES|QL is incredibly powerfull

There is also Transforms etc.

The throttling is a separate item, but Alerts have several forms of built in throttling throttling

So lets start with what version you are on..

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 27, 2024, 4:53pm UTC](https://discuss.elastic.co/t/dynamic-watcher-alerting-without-creating-100-watchers/356408/3 "2024-04-27T16:53:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.