# How to get data from watcher

**URL:** <https://discuss.elastic.co/t/how-to-get-data-from-watcher/83668>\
**Category:** Elasticsearch\
**Created:** [April 26, 2017, 9:12am UTC](https://discuss.elastic.co/t/how-to-get-data-from-watcher/83668 "2017-04-26T09:12:10Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![tatdat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tatdat/32/113160_2.png) [@tatdat](https://discuss.elastic.co/u/tatdat)\
**Post date:** [April 26, 2017, 9:12am UTC](https://discuss.elastic.co/t/how-to-get-data-from-watcher/83668/1 "2017-04-26T09:12:10Z")

</div>

I ussing watcher for monitor User login to server. If have new login send email alert to user and admin server ( have already file username, clientip, ssh)  
I have question.  
For example, my input in watcher matched with 20 total hit.  
How to send email to 20 user ? or another case , have 25 total hit matched , how to send email to 25 user ?

look like

```
 {
  "trigger" : {
    "schedule" : {
      "interval" : "1m"
    }
  },
  "input" : {
    "search" : {
      "request" : {
        "indices" : ["logs"],
        "body" : {
          "query": {
            "bool": {
              "must": [
              {
                  "match": {
                    "type": {
                      "query": "ssh"
                    }
                  }
                },
                {
                  "match": {
                    "ssh_type": {
                      "query": "login_success"
                    }
                  }
                }
              ]
            }
          }
        }
      }
    }
  },
  "condition" : {
    "compare" : { "ctx.payload.hits.total" : { "gte" : 1 }}
  }
  "actions" : {
  "notify-slack" : {
    "throttle_period" : "5m",
    "slack" : {
      "account" : "team1",
      "message" : {
        "from" : "watcher",
        "to" : ["#admins", "@chief-admin"],
        "text" : "System X Monitoring",
        "attachments" : [
        {
          "pretext": "Alert new login to server",
          "title" : "Server name (from field {{beat.hostname}})",
          "text" : "IP login, Usernamem, Time login",
          "color" : "#36a64f"
        }]
      }
    }
  }
  }
}

```

Thanks!

---

<div class="post-metadata">

**Author:** ![vovo](https://avatars.discourse-cdn.com/v4/letter/v/a4c791/32.png) [@vovo](https://discuss.elastic.co/u/vovo)\
**Post date:** [April 26, 2017, 11:24am UTC](https://discuss.elastic.co/t/how-to-get-data-from-watcher/83668/2 "2017-04-26T11:24:31Z")

</div>

Hi,

You need to set the send mail function in the actions, like:

"actions": {  
"send\_email": {  
"email": {  
"to": "",  
"subject": "",  
"body": "",  
"attachments": {  
"attached\_data": {  
"data": {  
"format": "json"  
}  
}  
},  
"priority": "high"  
}  
}  
}

I hope this helps.  
Vovo

---

<div class="post-metadata">

**Author:** ![tatdat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tatdat/32/113160_2.png) [@tatdat](https://discuss.elastic.co/u/tatdat)\
**Post date:** [April 26, 2017, 4:20pm UTC](https://discuss.elastic.co/t/how-to-get-data-from-watcher/83668/3 "2017-04-26T16:20:54Z")

</div>

thanks for suggestion,  
i think slack and email are same .  
And with ur mail function, it sent to one by one people, who in list matched 25 user ?

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [April 29, 2017, 2:08pm UTC](https://discuss.elastic.co/t/how-to-get-data-from-watcher/83668/4 "2017-04-29T14:08:49Z")

</div>

Hey,

you could extract the email addresses from the hits and join them with a command in the recipient address. However you can not send 25 different emails to 25 different recipients at the moment.

A better solution here would be to send the data to logstash using a webhook action and the logstash http input and do that over there.

--Alex

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 27, 2017, 2:11pm UTC](https://discuss.elastic.co/t/how-to-get-data-from-watcher/83668/5 "2017-05-27T14:11:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.