# Hostname error in Watcher | Heartbeat

**URL:** <https://discuss.elastic.co/t/hostname-error-in-watcher-heartbeat/137712>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [June 28, 2018, 1:55am UTC](https://discuss.elastic.co/t/hostname-error-in-watcher-heartbeat/137712 "2018-06-28T01:55:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![max17](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/max17/32/42694_2.png) [@max17](https://discuss.elastic.co/u/max17)\
**Post date:** [June 28, 2018, 1:55am UTC](https://discuss.elastic.co/t/hostname-error-in-watcher-heartbeat/137712/1 "2018-06-28T01:55:16Z")

</div>

Hello,

I am trying to set a Heartbeat monitor watcher so whenever the monitor status for a host goes down, I can get an email alert with the hostname, which I am not able to set correctly. Kindly look to at the Watcher please suggest.

Watcher:

{  
"trigger": {  
"schedule": {  
"interval": "10s"  
}  
},  
"input": {  
"search": {  
"request": {  
"search\_type": "query\_then\_fetch",  
"indices": [  
"heartbeat-\*"  
],  
"types": [],  
"body": {  
"query": {  
"bool": {  
"must": [  
{  
"range": {  
"@timestamp": {  
"gte": "now-10s"  
}  
}  
},  
{  
"match": {  
"monitor.status": "down"  
}  
}  
]  
}  
}  
}  
}  
}  
},  
"condition": {  
"compare": {  
"ctx.payload.hits.total": {  
"gte": 1  
}  
}  
},  
"actions": {  
"notify-slack": {  
"throttle\_period\_in\_millis": 2000,  
"slack": {  
"message": {  
"to": [  
"#watcher"  
],  
"text": "Warning. Host: {{ctx.payload.hits.hits.0.\_source.tags.0}} is down"  
}  
}  
}  
}  
}

The watcher is firing but I am getting the text as "Warning. Host: beats\_input\_raw\_event is down".

How can I get the name of hostnames in place of "beats\_input\_raw\_event" which was actually down in the email text. Please suggest.

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [June 29, 2018, 8:40am UTC](https://discuss.elastic.co/t/hostname-error-in-watcher-heartbeat/137712/2 "2018-06-29T08:40:35Z")

</div>

Hey,

instead of accessing the `tags` field from the first search result, you could use the `beat.hostname` field. Checking the search response by only executing the search instead of the watch (for example in the dev-tools console), will show you which fields are available and their path.

in the future, please properly format your snippets. This will make it much easier for people to read. You can use regular markdown here.

--Alex

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 27, 2018, 8:40am UTC](https://discuss.elastic.co/t/hostname-error-in-watcher-heartbeat/137712/3 "2018-07-27T08:40:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.