# Email is not been sent at the time when my portal is down , but it gets sent after a minute while using watcher elasticsearch

**URL:** https://discuss.elastic.co/t/email-is-not-been-sent-at-the-time-when-my-portal-is-down-but-it-gets-sent-after-a-minute-while-using-watcher-elasticsearch/182409
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [May 23, 2019, 11:01am UTC](https://discuss.elastic.co/t/email-is-not-been-sent-at-the-time-when-my-portal-is-down-but-it-gets-sent-after-a-minute-while-using-watcher-elasticsearch/182409 "2019-05-23T11:01:54Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![Vishnu\_mk](https://avatars.discourse-cdn.com/v4/letter/v/71c47a/32.png) [@Vishnu\_mk](https://discuss.elastic.co/u/Vishnu_mk)
#### Post date: [May 23, 2019, 11:01am UTC](https://discuss.elastic.co/t/email-is-not-been-sent-at-the-time-when-my-portal-is-down-but-it-gets-sent-after-a-minute-while-using-watcher-elasticsearch/182409/1 "2019-05-23T11:01:54Z")

</div>

```
           PUT _xpack/watcher/watch/watchertry
            {
              "trigger" : {
                "schedule" : {
              "interval" : "1m"
            }
          },
          "input" : {
            "search" : {
              "request" : {
                "indices" : [
                  "heartbeat-*"
                ],
                "body" : {
                  "size": 1,
                  "query" : {
                    "bool" : {
                      "must": [
                        {
                          "term": {
                            "monitor.status": {
                              "value": "down"
                            }
                          }
                        }
                      ],
                      "filter" : {
                        "range": {
                          "@timestamp": {
                            "from": "{{ctx.trigger.scheduled_time}}||-5m",
                            "to": "{{ctx.trigger.triggered_time}}"
                          }
                        }
                      }
                    }
                  }
                }
              }
            }
          },
          "condition" : {
            "compare" : { "ctx.payload.hits.total" : { "gt" : 0 }}
          },
          "actions" : {
            "email_admin" : {
              "email" : {
                "to" : "vishnumk@nseit.com",
                "subject" : "Priority : High State : Down ",
                "body": {
              "text": "Portal_URL:{{#ctx.payload.hits.hits}} {{_source.http.url}} {{/ctx.payload.hits.hits}}\n Time:{{#ctx.payload.hits.hits}} {{_source.@timestamp}} {{/ctx.payload.hits.hits}}\n Error:{{#ctx.payload.hits.hits}} {{_source.error.message}} {{/ctx.payload.hits.hits}}" 
            }
              }
            }
          }
        }

```

This is my watcher

---

<div class="post-metadata">

### Author: ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [May 23, 2019, 1:03pm UTC](https://discuss.elastic.co/t/email-is-not-been-sent-at-the-time-when-my-portal-is-down-but-it-gets-sent-after-a-minute-while-using-watcher-elasticsearch/182409/2 "2019-05-23T13:03:49Z")

</div>

you set the interval to `1m`, which means the check is running once per minute. That might explain the delay of up to one minute.

Hope that makes sense.

--Alex

---

<div class="post-metadata">

### Author: ![Vishnu\_mk](https://avatars.discourse-cdn.com/v4/letter/v/71c47a/32.png) [@Vishnu\_mk](https://discuss.elastic.co/u/Vishnu_mk)
#### Post date: [May 23, 2019, 1:06pm UTC](https://discuss.elastic.co/t/email-is-not-been-sent-at-the-time-when-my-portal-is-down-but-it-gets-sent-after-a-minute-while-using-watcher-elasticsearch/182409/3 "2019-05-23T13:06:41Z")

</div>

But what if I need the mail at the same time when my portal is down .  
And after that for every 1min interval i want to schedule .

---

<div class="post-metadata">

### Author: ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [May 23, 2019, 1:08pm UTC](https://discuss.elastic.co/t/email-is-not-been-sent-at-the-time-when-my-portal-is-down-but-it-gets-sent-after-a-minute-while-using-watcher-elasticsearch/182409/4 "2019-05-23T13:08:17Z")

</div>

then you may need to decrease the interval and have an additional check in your condition if the alert has already been triggered before by querying the watch history (this is somewhat tedious, but can be made working).

---

<div class="post-metadata">

### Author: ![Vishnu\_mk](https://avatars.discourse-cdn.com/v4/letter/v/71c47a/32.png) [@Vishnu\_mk](https://discuss.elastic.co/u/Vishnu_mk)
#### Post date: [May 23, 2019, 1:09pm UTC](https://discuss.elastic.co/t/email-is-not-been-sent-at-the-time-when-my-portal-is-down-but-it-gets-sent-after-a-minute-while-using-watcher-elasticsearch/182409/5 "2019-05-23T13:09:32Z")

</div>

Can you send me any demo examples

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 20, 2019, 1:09pm UTC](https://discuss.elastic.co/t/email-is-not-been-sent-at-the-time-when-my-portal-is-down-but-it-gets-sent-after-a-minute-while-using-watcher-elasticsearch/182409/6 "2019-06-20T13:09:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
