# Help with watcher alert configuration in Kibana

**URL:** <https://discuss.elastic.co/t/help-with-watcher-alert-configuration-in-kibana/174154>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [March 27, 2019, 3:05pm UTC](https://discuss.elastic.co/t/help-with-watcher-alert-configuration-in-kibana/174154 "2019-03-27T15:05:24Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Josip\_Cagalj](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/josip_cagalj/32/42899_2.png) [@Josip\_Cagalj](https://discuss.elastic.co/u/Josip_Cagalj)\
**Post date:** [March 27, 2019, 3:05pm UTC](https://discuss.elastic.co/t/help-with-watcher-alert-configuration-in-kibana/174154/1 "2019-03-27T15:05:24Z")

</div>

Hi, this is my first post so yes I'm a noob who just recently started with ELK. I'm trying to set up an advanced watcher in Kibana.  
Let's say I have one index 'store' which contains documents with fields e.g. 'amountSpent', 'purchaseDateTime', 'user', 'storeName', ... I would like to create an alert when Someone spends over 10 000. Next, I need to send a Slack notification with a message "User {user} spent {amountSpent} in {storeName}!".  
The watcher should run every 5 min and search for data not older than 5 min to avoid sending the slack notification multiple times for the same alert.  
Now, I already configured slack account and played with a threshold (simple) alert which is OK but with that, I can't get any additional field values to compose a message.  
My threshold alert configuration was:  
- 'Name': 'High Spent Alert',  
- 'Indices to query': 'store',  
- 'Time field': 'purchaseDateTime',  
- 'Run watch every': '5 min',  
- ' Matching the following condition': ' WHEN max() OF amountSpent OVER all documents IS ABOVE 10000 FOR THE LAST 5 minutes'  
- ' Will perform 1 action once met': 'Slack'  
i. 'Recipient': '{my address}'  
ii. 'Message': 'Watch [{{ctx.metadata.name}}] there was a purchase which amount spended over 10 000!'

Thanks in advance for any help!

---

<div class="post-metadata">

**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\
**Post date:** [March 27, 2019, 7:47pm UTC](https://discuss.elastic.co/t/help-with-watcher-alert-configuration-in-kibana/174154/2 "2019-03-27T19:47:20Z")

</div>

Hey @Josip_Cagalj, I'm going to move this question to the Elasticsearch topic because we have to use the "advanced watch" functionality in Kibana which essentially allows you to create a watch definition directly using the Elasticsearch APIs.

---

<div class="post-metadata">

**Author:** ![Josip\_Cagalj](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/josip_cagalj/32/42899_2.png) [@Josip\_Cagalj](https://discuss.elastic.co/u/Josip_Cagalj)\
**Post date:** [March 27, 2019, 8:38pm UTC](https://discuss.elastic.co/t/help-with-watcher-alert-configuration-in-kibana/174154/3 "2019-03-27T20:38:33Z")

</div>

Ok, thanks and sorry for posting in wrong thread

---

<div class="post-metadata">

**Author:** ![Josip\_Cagalj](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/josip_cagalj/32/42899_2.png) [@Josip\_Cagalj](https://discuss.elastic.co/u/Josip_Cagalj)\
**Post date:** [April 2, 2019, 1:51pm UTC](https://discuss.elastic.co/t/help-with-watcher-alert-configuration-in-kibana/174154/4 "2019-04-02T13:51:15Z")

</div>

Hi, I've successfully added my watch with email action. I'm now stuck in html body of my email. Here is the complete "html":

`"html": "There is a total of {{ctx.payload.hits.total}} purchases which exceeded the threshold:<br><br><table><tr><th>Amount</th><th>User</th><th>Time</th></tr> {{#ctx.payload.hits.hits}} {{{<tr><td>}}} {{_source.Amount}} {{{</td><td>}}} {{_source.User} {{{</td><td>}}} {{_source.purchaseDateTime}} {{{</td></tr>}}} {{/ctx.payload.hits.hits}} </table>"`

When the watcher is executed I'm getting:

`"html": "There is a total of 8 purchases which exceeded the threshold:<table><tr><th>Amount</th><th>User</th><th>Time</th></tr><tr><td> 1000000 </td><td> </td></tr><tr><td> 100500 </td><td> </td></tr><tr><td> 100000 </td><td> </td></tr><tr><td> 100500 </td><td> </td></tr><tr><td> 12220 </td><td> </td></tr><tr><td> 10020 </td><td> </td></tr><tr><td> 12220 </td><td> </td></tr><tr><td> 100000 </td><td> </td></tr></table>"`

Which ends up like this:

There is a total of 8 purchases which exceeded the threshold:

| Amount | User | Time |
| --- | --- | --- |
| 1000000 | |
| 100500 | |
| 100000 | |
| 100500 | |
| 12220 | |
| 10020 | |
| 12220 | |
| 100000 | |

As you can see I'm missing the Time and User part of the data and can't distinguish where is the error? So please if anyone can help I'd appreciate it. Thanks in advance

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [April 3, 2019, 7:46am UTC](https://discuss.elastic.co/t/help-with-watcher-alert-configuration-in-kibana/174154/5 "2019-04-03T07:46:06Z")

</div>

can you show a full sample document? Note that field names are case sensitive.

---

<div class="post-metadata">

**Author:** ![Josip\_Cagalj](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/josip_cagalj/32/42899_2.png) [@Josip\_Cagalj](https://discuss.elastic.co/u/Josip_Cagalj)\
**Post date:** [April 3, 2019, 12:22pm UTC](https://discuss.elastic.co/t/help-with-watcher-alert-configuration-in-kibana/174154/6 "2019-04-03T12:22:05Z")

</div>

Hi thanks for your replay. I made a mistake when posting last time. I've copied the wrong action response, so to clarify my email html body defined in action send\_email looks like this:

`"html": "There is a total of {{ctx.payload.hits.total}} purchases which exceeded the threshold:<br><br><table><tr><th>Amount</th><th>User</th><th>Time</th></tr> {{#ctx.payload.hits.hits}} {{{<tr><td>}}} {{_source.Amount}} {{{</td><td>}}} {{_source.User}{{{</td><td>}}} {{_source.purchaseDateTime}} {{{</td></tr>}}} {{/ctx.payload.hits.hits}} </table>"`

When executed this is the response:

`"html": "There is a total of 8 purchases which exceeded the threshold:<table><tr><th>Amount</th><th>User</th><th>Time</th></tr></table> 1000000 241 2019-03-12T02:21:44 100500 261 2019-03-16T12:08:56 100000 241 2019-03-16T12:08:56 100500 241 2019-03-16T12:08:56 12220 241 2019-03-23T05:52:36 10020 241 2019-03-23T05:52:36 12220 261 2019-03-23T05:52:36 100000 251 2019-03-26T12:08:56 "`

So the problem is that table closing tag `</table>` is put before looping through payload hits data. Also, there aren't any table tags (row, cell) inside the data?!

All the data are valid but displaying them in a table is something I can't accomplish

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [April 3, 2019, 2:13pm UTC](https://discuss.elastic.co/t/help-with-watcher-alert-configuration-in-kibana/174154/7 "2019-04-03T14:13:49Z")

</div>

This works for me

```auto
POST _xpack/watcher/watch/_execute
{
  "watch": {
    "trigger": {
      "schedule": {
        "interval": "10h"
      }
    },
    "input": {
      "simple": {
        "hits": {
          "hits": [
            {
              "_source": {
                "Amount": 123,
                "User": "123",
                "purchaseDateTime": "123"
              }
            },
            {
              "_source": {
                "Amount": 456,
                "User": "456",
                "purchaseDateTime": "456"
              }
            }
          ]
        }
      }
    },
    "actions": {
      "logme": {
        "logging": {
          "text": "There is a total of {{ctx.payload.hits.total}} purchases which exceeded the threshold:<br><br><table><tr><th>Amount</th><th>User</th><th>Time</th></tr> {{#ctx.payload.hits.hits}} <tr><td> {{_source.Amount}} </td><td> {{_source.User}} </td><td> {{_source.purchaseDateTime}} </td></tr> {{/ctx.payload.hits.hits}} </table>"
        }
      }
    }
  }
}

```

You forgot a closing `}` at `{{_source.User}`

---

<div class="post-metadata">

**Author:** ![Josip\_Cagalj](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/josip_cagalj/32/42899_2.png) [@Josip\_Cagalj](https://discuss.elastic.co/u/Josip_Cagalj)\
**Post date:** [April 3, 2019, 2:20pm UTC](https://discuss.elastic.co/t/help-with-watcher-alert-configuration-in-kibana/174154/8 "2019-04-03T14:20:42Z")

</div>

Wow, thanks. Got it to work now. I knew it was a matter of something simple but sometimes you can't see the thing which is just there in front of you 😉

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 1, 2019, 2:20pm UTC](https://discuss.elastic.co/t/help-with-watcher-alert-configuration-in-kibana/174154/9 "2019-05-01T14:20:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.