# Generating a list of hosts within past 15minutes

**URL:** <https://discuss.elastic.co/t/generating-a-list-of-hosts-within-past-15minutes/179306>\
**Category:** Kibana\
**Created:** [May 2, 2019, 8:18am UTC](https://discuss.elastic.co/t/generating-a-list-of-hosts-within-past-15minutes/179306 "2019-05-02T08:18:35Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jasonespo](https://avatars.discourse-cdn.com/v4/letter/j/898d66/32.png) [@Jasonespo](https://discuss.elastic.co/u/Jasonespo)\
**Post date:** [May 2, 2019, 8:18am UTC](https://discuss.elastic.co/t/generating-a-list-of-hosts-within-past-15minutes/179306/1 "2019-05-02T08:18:35Z")

</div>

Hi All,

Could I use watchers to generate a list of host\_names that have sent logs to ES in the past 15 minutes? I will need the output to be pushed to an API via a webhook and be output in a JSON format.

How would I achieve this

Jason

---

<div class="post-metadata">

**Author:** ![Jasonespo](https://avatars.discourse-cdn.com/v4/letter/j/898d66/32.png) [@Jasonespo](https://discuss.elastic.co/u/Jasonespo)\
**Post date:** [May 2, 2019, 12:00pm UTC](https://discuss.elastic.co/t/generating-a-list-of-hosts-within-past-15minutes/179306/2 "2019-05-02T12:00:05Z")

</div>

Answer if anyone is interested:

```
{
      "trigger": {
        "schedule": {
          "interval": "15m"
        }
      },
      "input": {
        "search": {
          "request": {
            "indices": [
              "test.*"
            ],
            "types": [],
            "body": {
              "size": 0,
              "query": {
                "bool": {
                  "filter": [
                    {
                      "range": {
                        "@timestamp": {
                          "gte": "now-{{ctx.metadata.window_period}}"
                        }
                      }
                    },
                    {
                      "exists": {
                        "field": "host"
                      }
                    }
                  ]
                }
              },
              "aggs": {
                "host": {
                  "terms": {
                    "field": "host"
                  },
                  "aggs": {
                    "events": {
                      "top_hits": {
                        "size": 1,
                        "_source": [
                          "host"
                        ]
                      }
                    }
                  }
                }
              }
            }
          }
        }
      },
      "condition": {
        "script": {
          "source": """
             def offenders = [];
            for (def host: ctx.payload.aggregations.host.buckets) {
                  if (host.doc_count >= 1) {
                    offenders.add([
                      'host': host.key,
                      'execution_time' : ctx.trigger.triggered_time
                    ]);
                  }
                }
          ctx.payload.offenders = offenders;
          return offenders.size() > 0;
    """,
          "lang": "painless"
        }
      },
      "actions": { },
            "body": "{{#toJson}}ctx.payload.offenders{{/toJson}}"
          }
        }
      },
      "metadata": {
        "window_period": "15m"
      },
      "throttle_period_in_millis": 120000
    }
```

---

<div class="post-metadata">

**Author:** ![tylersmalley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tylersmalley/32/8833_2.png) [@tylersmalley](https://discuss.elastic.co/u/tylersmalley)\
**Post date:** [May 2, 2019, 5:46pm UTC](https://discuss.elastic.co/t/generating-a-list-of-hosts-within-past-15minutes/179306/3 "2019-05-02T17:46:00Z")

</div>

Thanks for posting the solution!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 30, 2019, 5:46pm UTC](https://discuss.elastic.co/t/generating-a-list-of-hosts-within-past-15minutes/179306/4 "2019-05-30T17:46:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.