# Getting Repeated mail for same record in elasticsearch while am using watcher **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-alerting\ **Created:** [March 9, 2016, 5:01am UTC](https://discuss.elastic.co/t/getting-repeated-mail-for-same-record-in-elasticsearch-while-am-using-watcher/43854 "2016-03-09T05:01:39Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Gaurav\_Harsola](https://avatars.discourse-cdn.com/v4/letter/g/ecc23a/32.png) [@Gaurav\_Harsola](https://discuss.elastic.co/u/Gaurav_Harsola)\ **Post date:** [March 9, 2016, 5:01am UTC](https://discuss.elastic.co/t/getting-repeated-mail-for-same-record-in-elasticsearch-while-am-using-watcher/43854/1 "2016-03-09T05:01:40Z")
Hi, I have created an index using command [http://localhost:9200/event](http://localhost:9200/event) PUT { "settings" : { "number\_of\_shards" : 1 }, "mappings" :{ "event": { "properties": { "eventId": { "type": "integer" }, "eventName": { "type": "string" }, "eventDescription": { "type": "string" }, "eventCategory": { "type": "string" }, "eventType": { "type": "string" } ``` } } ``` }} After that i created a watcher :- PUT [http://localhost:9200/\_watcher/watch/event\_critical\_watch](http://localhost:9200/_watcher/watch/event_critical_watch) { "trigger": { "schedule": { "interval": "60s" } }, "input": { "search": { "request": { "indices": [ "event" ], "body": { "query": { "match": { "eventCategory": "CRITICAL" } } } } } }, "condition": { "compare": { "ctx.payload.hits.total": { "gt": 0 } } }, "actions": { "email\_admin": { "email": { "to": "'xyz@gmail.com'", "subject": "{{ctx.watch\_id}} executed", "body": "{{ctx.watch\_id}} executed with {{ctx.payload.hits.total}} hits" } } } } After that in elastisearc.yml i have made necessary changes :-- watcher.actions.email.service.account: gmail: profile: gmail smtp: auth: true starttls.enable: true host: [smtp.gmail.com](http://smtp.gmail.com) port: 587 user: [your-email@gmail.com](mailto:your-email@gmail.com) password: your-password after that when i create a simple event on event index with action as 'CRITICAL' Here is a sample event. ? PUT [http://localhost:9200/event/event/1](http://localhost:9200/event/event/1) { "eventId" : 1, "eventName" : "3 failed login attempts", "eventDescription" : "System has detected 3 failed login attempts", "eventCategory" : "CRITICAL", "eventType" : "LOG" } It send me a mail on my mail id ..but the issue is i am getting same mail for the same record for every 60sec ..Can't we stop sending mail for the record which we had sent earlier..this is really annoying.Please help me . ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [March 9, 2016, 6:52am UTC](https://discuss.elastic.co/t/getting-repeated-mail-for-same-record-in-elasticsearch-while-am-using-watcher/43854/2 "2016-03-09T06:52:25Z")
Hey Gaurav, watcher is doing exactly, what you told it to do: searching for any entry with the configured loglevel. If you dont want that, you have to add a timestamp to the event and always filter for the last minute (depending on your interval). See [https://www.elastic.co/guide/en/elasticsearch/guide/current/\_ranges.html](https://www.elastic.co/guide/en/elasticsearch/guide/current/_ranges.html) and [https://www.elastic.co/guide/en/elasticsearch/reference/2.2/query-dsl-range-query.html](https://www.elastic.co/guide/en/elasticsearch/reference/2.2/query-dsl-range-query.html) hope this helps. --Alex ---
**Author:** ![Gaurav\_Harsola](https://avatars.discourse-cdn.com/v4/letter/g/ecc23a/32.png) [@Gaurav\_Harsola](https://discuss.elastic.co/u/Gaurav_Harsola)\ **Post date:** [March 10, 2016, 5:10am UTC](https://discuss.elastic.co/t/getting-repeated-mail-for-same-record-in-elasticsearch-while-am-using-watcher/43854/3 "2016-03-10T05:10:02Z")
Hey Alexander, Thanks for quick response !! In my index , i dont have any time-stamp field . So if you dont mind can you help me out how to modify my code so that it dont send mail again and again for the same record. Thanks Gaurav ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [March 10, 2016, 6:45am UTC](https://discuss.elastic.co/t/getting-repeated-mail-for-same-record-in-elasticsearch-while-am-using-watcher/43854/4 "2016-03-10T06:45:10Z")
Hey Gaurav, if you need to filter your queries over time, you need to add a timestamp field. You could do this using the [\_timestamp field](https://www.elastic.co/guide/en/elasticsearch/reference/master/mapping-timestamp-field.html). However this is deprecated and might be removed in future releases. With the upcoming Elasticsearch 5.0 you could use an [ingest pipeline](https://www.elastic.co/guide/en/elasticsearch/reference/master/ingest.html) and have a processor that adds a new field and sets it to `{{now}}`. Hope this helps. --Alex ---
**Author:** ![Gaurav\_Harsola](https://avatars.discourse-cdn.com/v4/letter/g/ecc23a/32.png) [@Gaurav\_Harsola](https://discuss.elastic.co/u/Gaurav_Harsola)\ **Post date:** [March 13, 2016, 5:45pm UTC](https://discuss.elastic.co/t/getting-repeated-mail-for-same-record-in-elasticsearch-while-am-using-watcher/43854/5 "2016-03-13T17:45:45Z")
Hey Alexender, I am still not able to solve the problem .Can u help me out little bit more by filtering here based on time stamp for above problem??..while creating index Should we need to have time stamp field ,if we want to do filter based on timestamp. Thanks Gaurav ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [March 13, 2016, 10:40pm UTC](https://discuss.elastic.co/t/getting-repeated-mail-for-same-record-in-elasticsearch-while-am-using-watcher/43854/6 "2016-03-13T22:40:23Z")
Hey, yes you need a time based field in your documents, that you are indexing (or use the timestamp field mapper). Then you can use a time based range query to filter, see [the documentation about range queries](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-range-query.html#ranges-on-dates) If you have problems, please provide fully fledged examples as mentioned in [our help guidelines](https://www.elastic.co/help), so other people can chime in and follow your problem by concrete examples. --Alex ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:46pm UTC](https://discuss.elastic.co/t/getting-repeated-mail-for-same-record-in-elasticsearch-while-am-using-watcher/43854/7 "2017-07-06T13:46:36Z")