# How to set up a watcher for the status of beats
**URL:** https://discuss.elastic.co/t/how-to-set-up-a-watcher-for-the-status-of-beats/168260
**Category:** Beats
**Created:** [February 13, 2019, 5:04pm UTC](https://discuss.elastic.co/t/how-to-set-up-a-watcher-for-the-status-of-beats/168260 "2019-02-13T17:04:31Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@TheNmaptomyHeartBeat](https://discuss.elastic.co/u/TheNmaptomyHeartBeat)
#### Post date: [February 13, 2019, 5:04pm UTC](https://discuss.elastic.co/t/how-to-set-up-a-watcher-for-the-status-of-beats/168260/1 "2019-02-13T17:04:31Z")
Hello
We have `Filebeat`, `Metricbeat`, `Packetbeat`, and `Auditbeat` all enabled across multiple servers.
I am stumped as to how to set up a watcher that alerts me if a beat in a specific server goes down.
I've looked at `Central Management`, `Heartbeat` and looked at the `.monitoring-*` index. But without any luck.
`Central Management` doesn't seem to have an alert feature.
Heartbeat only works for `icmp`, `http`, or `tcp`.
the `.monitoring-*` index has beat data but if the beat is down I won't be receiving data from it. An idea I had is to query `Filebeat` monitoring data and if hit is 0 alert me.
But I am not sure if that's the best option or if it's practical.
Advice / recommendation would be appreciated.
Thanks in advance.
---
### Author:  [@shaunak](https://discuss.elastic.co/u/shaunak)
#### Post date: [February 13, 2019, 7:22pm UTC](https://discuss.elastic.co/t/how-to-set-up-a-watcher-for-the-status-of-beats/168260/2 "2019-02-13T19:22:04Z")
> [@TheNmaptomyHeartBeat](#):
>
> the `.monitoring-*` index has beat data but if the beat is down I won't be receiving data from it.
You could setup a watch that checks for the existence of data in `.monitoring-beats-*` in the past X duration. If it's not there, then it's possible the beat is down. There could be other reasons for the non-existence of data in this index (e.g. beat is up but there's a network issue somewhere along the path that gets the monitoring data from the beat into `.monitoring-beats-*`) so you might get some false positives.
---
### Author:  [@TheNmaptomyHeartBeat](https://discuss.elastic.co/u/TheNmaptomyHeartBeat)
#### Post date: [February 14, 2019, 11:56am UTC](https://discuss.elastic.co/t/how-to-set-up-a-watcher-for-the-status-of-beats/168260/3 "2019-02-14T11:56:50Z")
Hello Shaunak, thank you for your help.
I had a little think about this. How would I set up the query for that? and how would alerting work?
Is it a case of of checking there are records for mericbeat, filebeat, auditbeat and packetbeat on server1 and repeating that for every server? Because then the alerting wouldn't be specific. Ideally I would like an alert that says, filebeat for server1 is down.
Unless there is a better way to make the watcher?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 14, 2019, 1:56pm UTC](https://discuss.elastic.co/t/how-to-set-up-a-watcher-for-the-status-of-beats/168260/4 "2019-03-14T13:56:52Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.