# How to send logs by watchers action

**URL:** <https://discuss.elastic.co/t/how-to-send-logs-by-watchers-action/273530>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting\
**Created:** [May 20, 2021, 12:19pm UTC](https://discuss.elastic.co/t/how-to-send-logs-by-watchers-action/273530 "2021-05-20T12:19:25Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![luczajk](https://avatars.discourse-cdn.com/v4/letter/l/a87d85/32.png) [@luczajk](https://discuss.elastic.co/u/luczajk)\
**Post date:** [May 20, 2021, 12:19pm UTC](https://discuss.elastic.co/t/how-to-send-logs-by-watchers-action/273530/1 "2021-05-20T12:19:25Z")

</div>

I'm trying to find a way to send every log which attribute "Exception" includes "statusCode: 500" and word "exception". At this time my watcher send information about 10000 logs every check. But its wrong, if i check it manually there is no logs with that attributes. Can you help me how to find just these logs? And is there any possibility for making separate emails for each bugs? I mean a situation where a separate email is sent with the full log.

> ```
> {
> "trigger": {
> "schedule": {
> "interval": "900m"
> }
> },
> "input": {
> "search": {
> "request": {
> "search_type": "query_then_fetch",
> "indices": [
> "=hpiprod="
> ],
> "rest_total_hits_as_int": true,
> "body": {
> "query": {
> "bool": {
> "must": [
> {
> "match": {
> "Exception": "Exception"
> }
> },
> {
> "match": {
> "Exception": "StatusCode: 500"
> }
> }
> ]
> }
> }
> }
> }
> }
> },
> "condition": {
> "compare": {
> "ctx.payload.hits.total": {
> "gt": 0
> }
> }
> },
> "actions": {
> "send_email": {
> "email": {
> "profile": "standard",
> "to": [
> "test@test.com"
> ],
> "subject": "testlogs",
> "body": {
> "text": "{{ctx.payload.hits.total}} Errors have occured in the logs:{{#ctx.payload.hits.hits}}{{_id}}:{{/ctx.payload.hits.hits}} Result Message:{{#ctx.payload.hits.hits}}{{_source.message}}:{{/ctx.payload.hits.hits}}"
> }
> }
> }
> }
> }
> 
> ```

---

<div class="post-metadata">

**Author:** ![Dzmitry](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dzmitry/32/65026_2.png) [@Dzmitry](https://discuss.elastic.co/u/Dzmitry)\
**Post date:** [May 21, 2021, 11:10am UTC](https://discuss.elastic.co/t/how-to-send-logs-by-watchers-action/273530/2 "2021-05-21T11:10:26Z")

</div>

Hi @luczajk ,

Did you try to run your search query in Dev Tools -\> Console?  
Are you getting the results you expect to see?

What stack version do you use?

Just in case you did not check it, here is a [documentation](https://www.elastic.co/guide/en/elasticsearch/reference/master/input-search.html) with examples for watcher input search.

Regards, Dzmitry

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 18, 2021, 11:10am UTC](https://discuss.elastic.co/t/how-to-send-logs-by-watchers-action/273530/3 "2021-06-18T11:10:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.