# Execution of a watcher when another one has been executed **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-monitoring, elastic-stack-alerting\ **Created:** [October 19, 2020, 3:21pm UTC](https://discuss.elastic.co/t/execution-of-a-watcher-when-another-one-has-been-executed/252572 "2020-10-19T15:21:54Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Post date:** [October 19, 2020, 3:21pm UTC](https://discuss.elastic.co/t/execution-of-a-watcher-when-another-one-has-been-executed/252572/1 "2020-10-19T15:21:54Z")
hello good, I need help with the trigger of an alert, I want it to run when another alert has been executed, I do not know if you explain to me when I detect that another alert has been executed this is executed. I do not know if this is possible, but I need to know if it can be done, thanks. **this is the alert I need to activate when the other one has been executed**... ```auto { "trigger": { "schedule": { "interval": "1h" } }, "input": { "search": { "request": { "search_type": "query_then_fetch", "indices": [ "agenteallot*" ], "rest_total_hits_as_int": true, "body": { "size": 0, "query": { "bool": { "filter": [ { "range": { "@timestamp": { "gte": "{{ctx.trigger.scheduled_time}}||-5m", "lte": "{{ctx.trigger.scheduled_time}}", "format": "strict_date_optional_time||basic_time_no_millis" } } }, { "term": { "monitor.name.keyword": "04-1-CAV30CI1012712-VIVERO-PPAL-384M-99.8" } } ] } }, "aggs": { "metricAgg": { "max": { "field": "summary.down" } } } } } } }, "condition": { "script": { "source": "if (ctx.payload.aggregations.metricAgg.value >= params.threshold) { return false; } return true;", "lang": "painless", "params": { "threshold": 0.8 } } }, "actions": { "email_1": { "email": { "profile": "standard", "attach_data": { "format": "yaml" }, "to": [ "victor.vera@megadvantage.com", "telecomunicaciones@udistrital.edu.co", "juan.jaramillo@megadvantage.com", "juancho.jaramillo16@gmail.com", "oscar.ninog.pr@etb.com.co", "jose.caceresg@etb.com.co", "karen.marriagaj.pr@etb.com.co" ], "subject": "{{ctx.metadata.name}} ", "body": { "text": """Buen dia, Adjunto registro del reporte. 鈿狅笍ALERTA NODO!!! El siguiente enlace ha restablecido la conexi贸n. Estado: UP馃煝 Nombre del Enlace: 04-1-CAV30CI1012712-VIVERO-PPAL-384M-99.8 馃暓Hora: {{ctx.payload.time_triggered}} {{ctx.result.execution_time}} 脕rea: Networking 馃敂Mensaje Alerta: El enlace ha vuelto a responder. Responder correo a telecomunicaciones@udistrital.edu.co Ingrese aqu铆 para m谩s informaci贸n: https://72dfe17217744236af40cc31b704a664.us-central1.gcp.cloud.es.io:9243/s/distrital/app/uptime#""" } } } }, "transform": { "script": { "source": "return ['time_triggered': Instant.ofEpochMilli(ctx.trigger.triggered_time.getMillis()).atZone(ZoneId.of('America/Bogota')).format(DateTimeFormatter.ofPattern('YYYY-MM-dd HH:mm:ss'))];", "lang": "painless" } } } ``` **and this is the alert that is executed before the previous one is activated.**... ```auto { "trigger": { "schedule": { "interval": "1h" } }, "input": { "search": { "request": { "search_type": "query_then_fetch", "indices": [ "agenteallot*" ], "rest_total_hits_as_int": true, "body": { "size": 0, "query": { "bool": { "filter": [ { "range": { "@timestamp": { "gte": "{{ctx.trigger.scheduled_time}}||-5m", "lte": "{{ctx.trigger.scheduled_time}}", "format": "strict_date_optional_time||basic_time_no_millis" } } }, { "term": { "monitor.name.keyword": "04-1-CAV30CI1012712-VIVERO-PPAL-384M-99.8" } } ] } }, "aggs": { "metricAgg": { "max": { "field": "summary.down" } } } } } } }, "condition": { "script": { "source": "if (ctx.payload.aggregations.metricAgg.value >= params.threshold) { return true; } return false;", "lang": "painless", "params": { "threshold": 0.8 } } }, "actions": { "email_1": { "email": { "profile": "standard", "attach_data": { "format": "yaml" }, "to": [ "victor.vera@megadvantage.com", "telecomunicaciones@udistrital.edu.co", "juan.jaramillo@megadvantage.com", "juancho.jaramillo16@gmail.com", "oscar.ninog.pr@etb.com.co", "jose.caceresg@etb.com.co", "karen.marriagaj.pr@etb.com.co" ], "subject": "{{ctx.metadata.name}} ", "body": { "text": """Buen dia, Adjunto registro del reporte. 鈿狅笍ALERTA NODO!!! El siguiente enlace perdi贸 la conexi贸n. Estado: Down馃敶 Nombre del Enlace: 04-1-CAV30CI1012712-VIVERO-PPAL-384M-99.8 馃暓Hora: {{ctx.payload.time_triggered}} {{ctx.result.execution_time}} 脕rea: Networking 馃敂Mensaje Alerta: El enlace ha dejado de responder. Responder correo a telecomunicaciones@udistrital.edu.co Ingrese aqu铆 para m谩s informaci贸n: https://72dfe17217744236af40cc31b704a664.us-central1.gcp.cloud.es.io:9243/s/distrital/app/uptime#""" } } } }, "transform": { "script": { "source": "return ['time_triggered': Instant.ofEpochMilli(ctx.trigger.triggered_time.getMillis()).atZone(ZoneId.of('America/Bogota')).format(DateTimeFormatter.ofPattern('YYYY-MM-dd HH:mm:ss'))];", "lang": "painless" } } } ``` ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [October 21, 2020, 7:55am UTC](https://discuss.elastic.co/t/execution-of-a-watcher-when-another-one-has-been-executed/252572/2 "2020-10-21T07:55:07Z")
There is a watcher history index that contains information about all watch executions. You could query that one as part of your watch. ```auto GET .watcher-history-*/_search { "size": 1, "query": { "bool": { "filter": [ { "term": { "watch_id": "my_watch" } } ] } }, "sort": [ { "trigger_event.triggered_time": { "order": "desc" } } ] } ``` Hope this helps! --Alex ---
**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Post date:** [October 21, 2020, 3:52pm UTC](https://discuss.elastic.co/t/execution-of-a-watcher-when-another-one-has-been-executed/252572/3 "2020-10-21T15:52:27Z")
thanks, but how do I set that up in the watch I mean in the trigger? ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [October 21, 2020, 3:53pm UTC](https://discuss.elastic.co/t/execution-of-a-watcher-when-another-one-has-been-executed/252572/4 "2020-10-21T15:53:54Z")
with a [chain input](https://www.elastic.co/guide/en/elasticsearch/reference/7.9/input-chain.html) ---
**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\ **Post date:** [October 21, 2020, 5:09pm UTC](https://discuss.elastic.co/t/execution-of-a-watcher-when-another-one-has-been-executed/252572/5 "2020-10-21T17:09:00Z")
Thanks, very useful, but I have a question when making that input chain, when I run the clock will do that first? ie how can I make the clock runs if it meets a condition of execution, I mean that if you detect that this executed the other clock, run this. ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [October 22, 2020, 9:42am UTC](https://discuss.elastic.co/t/execution-of-a-watcher-when-another-one-has-been-executed/252572/6 "2020-10-22T09:42:31Z")
I'm sorry, but I have no idea what you refer to by a clock or a clock run, please explain. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 19, 2020, 9:42am UTC](https://discuss.elastic.co/t/execution-of-a-watcher-when-another-one-has-been-executed/252572/7 "2020-11-19T09:42:34Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.