# Help with query from Metricbeat index
**URL:** https://discuss.elastic.co/t/help-with-query-from-metricbeat-index/129546
**Category:** Elasticsearch
**Created:** [April 25, 2018, 6:20pm UTC](https://discuss.elastic.co/t/help-with-query-from-metricbeat-index/129546 "2018-04-25T18:20:04Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@vonpelz](https://discuss.elastic.co/u/vonpelz)
#### Post date: [April 25, 2018, 6:20pm UTC](https://discuss.elastic.co/t/help-with-query-from-metricbeat-index/129546/1 "2018-04-25T18:20:05Z")
Hi,
I'm new to Elastic stack, just set up a small cluster and sending metrics with Metricbeat from a few hosts.
I'd like to create a watcher that will send an email if the disk space on a disk on a host goes below 9 GB. Then I'd like that mail to include info with hostname, diskname and how much space there was at the time the watcher was triggered.
I assume this requires a custom watcher? I started experimenting with Elasticsearch queries trying to come up with a query that would return result as distinct hostname and drive. However, this is way above my current skill level. Could anyone help out? This is what I have at the moment, but it just returns every document where the criteria is met.
```
GET /metricbeat-*/_search
{
"query": {
"bool": {
"must" : {
"match": {
"system.filesystem.type": "fixed"
}
},
"filter": [
{
"range" : {
"system.filesystem.available": { "lte": 9663676416 }
}
},
{
"range": {
"@timestamp": {
"from": "now-10m", "to": "now"
}
}
}
]
}
}
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 23, 2018, 6:20pm UTC](https://discuss.elastic.co/t/help-with-query-from-metricbeat-index/129546/2 "2018-05-23T18:20:11Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.