# Hearbeat watcher template

**URL:** https://discuss.elastic.co/t/hearbeat-watcher-template/137561
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [June 27, 2018, 7:47am UTC](https://discuss.elastic.co/t/hearbeat-watcher-template/137561 "2018-06-27T07:47:38Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Dinesh\_Senthil\_Kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dinesh_senthil_kumar/32/48983_2.png) [@Dinesh\_Senthil\_Kumar](https://discuss.elastic.co/u/Dinesh_Senthil_Kumar)
#### Post date: [June 27, 2018, 7:47am UTC](https://discuss.elastic.co/t/hearbeat-watcher-template/137561/1 "2018-06-27T07:47:41Z")

</div>

HI  
do we have default watcher for heartbeat monitoring. i need an alert by mail when a server goes down.

---

<div class="post-metadata">

### Author: ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [June 27, 2018, 12:12pm UTC](https://discuss.elastic.co/t/hearbeat-watcher-template/137561/2 "2018-06-27T12:12:00Z")

</div>

Hey,

there is no common example. The main reason for this is, that there are many different definitions of down and how to act on it. Do you want to have an email sent, if there is only a single `DOWN` event for a host? Or do you wait for at least three events? Would you like not to get notified after the first `DOWN` event and so forth. So this looks easy on the outside, but it's important to think through it.

if you come up with your scenario we can check what we can do about it.

--Alex

---

<div class="post-metadata">

### Author: ![Dinesh\_Senthil\_Kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dinesh_senthil_kumar/32/48983_2.png) [@Dinesh\_Senthil\_Kumar](https://discuss.elastic.co/u/Dinesh_Senthil_Kumar)
#### Post date: [June 27, 2018, 2:08pm UTC](https://discuss.elastic.co/t/hearbeat-watcher-template/137561/3 "2018-06-27T14:08:41Z")

</div>

HI Alex,

Thanks for the revert, we want to be notified as soon as server goes down. we are pinging this for every 50seconds and running the watcher for 1m.

---

<div class="post-metadata">

### Author: ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [June 29, 2018, 12:46pm UTC](https://discuss.elastic.co/t/hearbeat-watcher-template/137561/4 "2018-06-29T12:46:38Z")

</div>

then you basically just need to query for the `down` state and have a `terms` aggregation on the `id` of the heartbeat.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 27, 2018, 12:46pm UTC](https://discuss.elastic.co/t/hearbeat-watcher-template/137561/5 "2018-07-27T12:46:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
