# How to show the beat.hostname in watcher notificaiton
**URL:** https://discuss.elastic.co/t/how-to-show-the-beat-hostname-in-watcher-notificaiton/86477
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [May 19, 2017, 6:36pm UTC](https://discuss.elastic.co/t/how-to-show-the-beat-hostname-in-watcher-notificaiton/86477 "2017-05-19T18:36:38Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Balaram](https://discuss.elastic.co/u/Balaram)
#### Post date: [May 19, 2017, 6:36pm UTC](https://discuss.elastic.co/t/how-to-show-the-beat-hostname-in-watcher-notificaiton/86477/1 "2017-05-19T18:36:39Z")
Hi,
I am trying to create a watch for monitoring the system metrics ( for e.g load, Memory or disk usage) and send notifications when certain threshold is breached along with the beatname details.
Currently have the below watch script which is working but not showing up the server name. So looking for your help ..
PUT \_xpack/watcher/watch/system-load-used-alert/
{
"trigger": {
"schedule": {
"interval" : "10s"
}
},
"input" : {
"search" : {
"request" : {
"search\_type": "query\_then\_fetch",
"indices" : [
"cadopsxlr-{now/d}"
],
"types":[],
"body": {
"size": 0,
"query": {
"range":{
"system.load.1":{
"gt":"4.0"
}
}
}
}
```
}
}
```
},
"condition" : {
"compare" : {
"ctx.payload.hits.total" : {
"gt" : "0"
}
}
},
"actions": {
"log": {
"throttle\_period": "15m",
"logging": {
"level": "INFO",
"text": "\*\*\*\*High system load noticed on server {{XYZ}} \*\*\* "
}
}
}
}
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [May 22, 2017, 6:42am UTC](https://discuss.elastic.co/t/how-to-show-the-beat-hostname-in-watcher-notificaiton/86477/2 "2017-05-22T06:42:05Z")
Hey,
this is not a question about watcher, but merely about how to write a query, that also includes such information. For this concrete example you will need an aggregation, that will count the occurence of each `beat.hostname` value in the documents that match. For this you do need a `terms` aggregation. You can check out the documentation over [here](https://www.elastic.co/guide/en/elasticsearch/reference/5.4/search-aggregations-bucket-terms-aggregation.html). Once you got this aggregation right, you can loop through the array of returned buckets and use each found hostname in the bucket. You might want to check out the mustache docs for this [https://mustache.github.io/mustache.5.html](https://mustache.github.io/mustache.5.html)
In addition you could use the `join` mustache operator, that joins together an array of values, see [https://www.elastic.co/guide/en/elasticsearch/reference/5.4/search-template.html#\_concatenating\_array\_of\_values](https://www.elastic.co/guide/en/elasticsearch/reference/5.4/search-template.html#_concatenating_array_of_values) (that requires a `transform` before that using though, so you should start slowly).
If you dont prefer reading all those docs and you want to dive right in, checking out some example watches might make sense as well, see here [https://github.com/elastic/examples/tree/master/Alerting](https://github.com/elastic/examples/tree/master/Alerting)
--Alex
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 19, 2017, 6:42am UTC](https://discuss.elastic.co/t/how-to-show-the-beat-hostname-in-watcher-notificaiton/86477/3 "2017-06-19T06:42:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.