# Dynamic watcher/alerting without creating multiple watches

**URL:** <https://discuss.elastic.co/t/dynamic-watcher-alerting-without-creating-multiple-watches/377432>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [April 23, 2025, 11:47am UTC](https://discuss.elastic.co/t/dynamic-watcher-alerting-without-creating-multiple-watches/377432 "2025-04-23T11:47:18Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rukmangadha\_Ajay](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rukmangadha_ajay/32/142753_2.png) [@Rukmangadha\_Ajay](https://discuss.elastic.co/u/Rukmangadha_Ajay)\
**Post date:** [April 23, 2025, 11:47am UTC](https://discuss.elastic.co/t/dynamic-watcher-alerting-without-creating-multiple-watches/377432/1 "2025-04-23T11:47:18Z")

</div>

Hi all,

I’m using Elasticsearch (with Kibana) to log IBM ACE message flow exceptions, and I’ve already built pipelines to successfully index logs. Now, I need to configure a **Watcher** to send **email alerts** based on specific logic.

### Objective

Send **email alerts for exceptions** , with the following logic:

1. **Scenario 1 – Single Exception Once**

- Interface: `KN550`
- Exception: `Internal Server Error` (only occurred once)
- **Send one mail**

1. **Scenario 2 – Repeated Exception within 30 Minutes**

- Interface: `KN540`
- Exception: `Bad Request` (occurred multiple times in 30 mins)
- **Send only one mail in a 30-minute window**
- **If the error persists beyond 30 mins, send again**

1. **Scenario 3 – Same Exception, Different Flows**

- Interface: `KN559`
- Different message flows: `MF1`, `MF2`, `MF3`
- Each with a unique or same exception
- **Send one mail per message flow per exception** , even if the error text is the same

* * *

Note: My Exception field contains long stack trace.

### My Question

Is it possible to achieve this scenario using **Kibana Watchers**?