# How to update a watch to look for KEYWORD on a FILE instead of WHOLE INDEX?

**URL:** <https://discuss.elastic.co/t/how-to-update-a-watch-to-look-for-keyword-on-a-file-instead-of-whole-index/39474>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [January 18, 2016, 8:03pm UTC](https://discuss.elastic.co/t/how-to-update-a-watch-to-look-for-keyword-on-a-file-instead-of-whole-index/39474 "2016-01-18T20:03:19Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![robertranjan](https://avatars.discourse-cdn.com/v4/letter/r/b5a626/32.png) [@robertranjan](https://discuss.elastic.co/u/robertranjan)\
**Post date:** [January 18, 2016, 8:03pm UTC](https://discuss.elastic.co/t/how-to-update-a-watch-to-look-for-keyword-on-a-file-instead-of-whole-index/39474/1 "2016-01-18T20:03:19Z")

</div>

I have created a watch to look for a keyword **sudo** on a index **syslog** and send email alert. No problem, works as expected.

Now I need update the watch to look for the same keyword at **/var/log/secure** file instead of **whole Index.** Currently all the syslog files are writing to the same index **syslog**.

Can someone help me to do it?

Here is my current watch look like:

> {  
> "trigger": {  
> "schedule": {  
> "interval": "1h"  
> }  
> },  
> "input": {  
> "search": {  
> "request": {  
> "indices": [  
> "syslog\*"  
> ],  
> "body": {  
> "query" : {  
> "filtered" : {  
> "query" : {  
> "match\_phrase" : {  
> "message": " sudo:"  
> }  
> },  
> "filter" : {  
> "range" : {"@timestamp" : {"gte" : "now-1h"}}  
> }  
> }  
> }  
> }  
> }  
> }  
> },  
> "condition": {  
> "compare": {  
> "ctx.payload.hits.total": {  
> "gt": 1  
> }  
> }  
> },  
> "actions": {  
> "send\_email": {  
> "email": {  
> "to": "[watch\_alerts@domain.com](mailto:watch_alerts@domain.com)",  
> "subject": "[Test - sudo Watch] Found {{ ctx.payload.hits.total }} sudo commands",  
> "body": "Found sudo commands. Total logins: {{ ctx.payload.hits.total }} \nYou may need to update this body the way you want it.",  
> "attach\_data": {  
> "format": "json"  
> }  
> }  
> }  
> }  
> }

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [January 21, 2016, 10:58am UTC](https://discuss.elastic.co/t/how-to-update-a-watch-to-look-for-keyword-on-a-file-instead-of-whole-index/39474/2 "2016-01-21T10:58:29Z")

</div>

Hey,

this depends solely depends on the your data model and if additional data, like the file path you are searching for, have been indexed and are searchable.

So the question is, do you index the required data in order to extend the query? If so you can extend your the `query` part of the filtered query to be a `bool` query with two `must` clauses.

Hope this helps.

--Alex

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:47pm UTC](https://discuss.elastic.co/t/how-to-update-a-watch-to-look-for-keyword-on-a-file-instead-of-whole-index/39474/3 "2017-07-06T13:47:17Z")

</div>