# Getting error while configuring watcher alerts

**URL:** <https://discuss.elastic.co/t/getting-error-while-configuring-watcher-alerts/125470>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [March 25, 2018, 8:36am UTC](https://discuss.elastic.co/t/getting-error-while-configuring-watcher-alerts/125470 "2018-03-25T08:36:45Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jskumar](https://avatars.discourse-cdn.com/v4/letter/j/b77776/32.png) [@jskumar](https://discuss.elastic.co/u/jskumar)\
**Post date:** [March 25, 2018, 8:36am UTC](https://discuss.elastic.co/t/getting-error-while-configuring-watcher-alerts/125470/1 "2018-03-25T08:36:45Z")

</div>

Hi,

I want to set watcher alert in which it should alert me if there is any 5XX calls for more than 1 hour. I using this code but it is giving me "ParsingException[[match] malformed query, expected [END\_OBJECT] but found [FIELD\_NAME]]" .  
Also the index name changes every day i.e logstash-2018.03.23 on next day it would be logstash-2018.03.24. How can i configure this . Please help me on this

\</\>PUT \_xpack/watcher/watch/5xx alert  
{  
"trigger": {  
"schedule": {  
"interval": "60s"  
}  
},  
"input": {  
"search": {  
"request": {  
"indices": [  
"logstash-2018.03.23"  
],  
"body": {  
"query": {  
"match": {  
"response\_code": "5\*\*"  
},

```
					{
					"range" : {
					"timestamp": {
					"gte" : "now-1h",
					"lte" : "now"
						          }
						     }
					}	         			
                }
            }
        }
    }
},
"condition": {
    "compare": {
        "ctx.payload.hits.total": {
            "gt": 0
        }
    }
},
"actions": {
    "send_email": {
        "email": {
            "to": "emailid",
            "subject": "Watcher 2xx executed",
            "body": "{{ctx.watch_id}} executed with {{ctx.payload.hits.total}} hits"
        }
    }
}

```

}  
\</\>

---

<div class="post-metadata">

**Author:** ![jskumar](https://avatars.discourse-cdn.com/v4/letter/j/b77776/32.png) [@jskumar](https://discuss.elastic.co/u/jskumar)\
**Post date:** [March 25, 2018, 8:43am UTC](https://discuss.elastic.co/t/getting-error-while-configuring-watcher-alerts/125470/2 "2018-03-25T08:43:00Z")

</div>

Below are the code which iam trying.

PUT \_xpack/watcher/watch/5xx\_alert  
{  
"trigger": {  
"schedule": {  
"interval": "60s"  
}  
},  
"input": {  
"search": {  
"request": {  
"indices": [  
"logstash-2018.03.23"  
],  
"body": {  
"query": {  
"match": {  
"response\_code": "5\*\*"  
},

```
					{
					"range" : {
					"timestamp": {
					"gte" : "now-1h",
					"lte" : "now"
						          }
						     }
					}	         			
                }
            }
        }
    }
},
"condition": {
    "compare": {
        "ctx.payload.hits.total": {
            "gt": 0
        }
    }
},
"actions": {
    "send_email": {
        "email": {
            "to": "emailid",
            "subject": "Watcher 5xx executed",
            "body": "{{ctx.watch_id}} executed with {{ctx.payload.hits.total}} hits"
        }
    }
}

```

}

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [March 26, 2018, 7:20am UTC](https://discuss.elastic.co/t/getting-error-while-configuring-watcher-alerts/125470/3 "2018-03-26T07:20:05Z")

</div>

please take your time to properly format your request. This is very hard to read.

Instead of writing the watch, please take a step back, extract the query and run it using a regular `_search` request and see if it works. I highly doubt it, as it looks, as if you are not using a bool query with several filter clauses.

Also the syntax you are using `5**` should be replaced with a range query (search for everything between 500 and 599).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 23, 2018, 7:20am UTC](https://discuss.elastic.co/t/getting-error-while-configuring-watcher-alerts/125470/4 "2018-04-23T07:20:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.