# How to suppress watches alerts

**URL:** <https://discuss.elastic.co/t/how-to-suppress-watches-alerts/143342>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [August 7, 2018, 1:58pm UTC](https://discuss.elastic.co/t/how-to-suppress-watches-alerts/143342 "2018-08-07T13:58:49Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![addanuj](https://avatars.discourse-cdn.com/v4/letter/a/d2c977/32.png) [@addanuj](https://discuss.elastic.co/u/addanuj)\
**Post date:** [August 7, 2018, 1:58pm UTC](https://discuss.elastic.co/t/how-to-suppress-watches-alerts/143342/1 "2018-08-07T13:58:50Z")

</div>

Is their any way which i can use to suppress watch alerts

I am using ELK AS A SIEM, and this seems to be a major problem as i get multiple alerts when ever watch condition gets true, for example if i am getting alerts from a watch for same host i need some mechanism which can intelligently suppress all alerts according to my given condition for suppression.... Like suppress all alerts for an hour if found same host and send a single alert with count.

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [August 8, 2018, 8:29am UTC](https://discuss.elastic.co/t/how-to-suppress-watches-alerts/143342/2 "2018-08-08T08:29:20Z")

</div>

Hey,

watches and their executionsare stateless and not connected with other watches. If you want to do that, you would need to implement that yourself. A possible way to do this (which admittantly is cumbersome), is to add a `hostname` field in the [watch metadata](https://www.elastic.co/guide/en/elastic-stack-overview/6.3/how-watcher-works.html#CO15-1), and then use a [chained input](https://www.elastic.co/guide/en/elastic-stack-overview/6.3/input-chain.html), that queries the watch history for watches with this metadata and check if the condition was met. If this is the case, do not run the actions of this watch by checking this

The query would be sth like this

```auto
GET .watcher-history-*/_search
{
  "query": {
    "bool": {
      "must": [
        {
          "range": {
            "trigger_event.triggered_time": {
              "gte": "now-1h",
              "lte": "now"
            }
          }
        },
        {
          "term": {
            "metadata.host.keyword": {
              "value": "my_host"
            }
          }
        },
        {
          "term": {
            "result.condition.met": {
              "value": "true"
            }
          }
        }
      ]
    }
  }
}

```

inside of each watch you could check if the above query has more than zero hits in your condition and only then trigger the watch.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 5, 2018, 8:29am UTC](https://discuss.elastic.co/t/how-to-suppress-watches-alerts/143342/3 "2018-09-05T08:29:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.