# How to write a watcher with match, term aggregation, and count?

**URL:** <https://discuss.elastic.co/t/how-to-write-a-watcher-with-match-term-aggregation-and-count/158551>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [November 28, 2018, 10:53am UTC](https://discuss.elastic.co/t/how-to-write-a-watcher-with-match-term-aggregation-and-count/158551 "2018-11-28T10:53:40Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![elasticheart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticheart/32/65189_2.png) [@elasticheart](https://discuss.elastic.co/u/elasticheart)\
**Post date:** [November 28, 2018, 10:53am UTC](https://discuss.elastic.co/t/how-to-write-a-watcher-with-match-term-aggregation-and-count/158551/1 "2018-11-28T10:53:40Z")

</div>

Hi,

I am using 6.5 GA stack. I use heartbeat to ping to 3 hosts like `hosts: ["192.168.0.1:9092","192.168.0.2:9093","192.168.0.3:9094"]` and push them to heartbeat index. Mapping can be found at [http://freetexthost.com/ddx5am0udp](http://freetexthost.com/ddx5am0udp) because it is lengthy

I am trying out "features" to check if its worth buying a license, and dont know if it can satisfy my use case. I would like to know, if it is possible to send alert based on my conditions;

1. monitor.status = `down`
2. Watcher should run on every 2 minutes
3. If count for any of the `hosts` is `>=` 3, then email alert should come

Somebody kindly help me to write `query` part of the rule? Below is my current config;

```
    "body": {
      "query": {
        "bool": {
          "filter": {
            "range": {
              "@timestamp": {
                "gte": "now-30s/s",
                "lte": "now/s",
                "format": "epoch_millis"
              }
            }
          },
          "must": {
            "match": {
              "monitor.status": "down"
            }
          }
        }
      },
      "size": 0,
      "aggs": {
        "termAgg": {
          "terms": {
            "field": "monitor.host"
          }
        }
      }
    }

```

Thanks

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [November 29, 2018, 9:46am UTC](https://discuss.elastic.co/t/how-to-write-a-watcher-with-match-term-aggregation-and-count/158551/2 "2018-11-29T09:46:48Z")

</div>

the query part looks good. I think the interesting part is the condition where you need to check if the `doc_count` in any of the buckets is greater than three - this basically means you need to go through each of the buckets and check for the `doc_count` field.

A good start for this could be the alerting examples in the [examples repo](https://github.com/elastic/examples/tree/master/Alerting)

hope this helps!

---

<div class="post-metadata">

**Author:** ![elasticheart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticheart/32/65189_2.png) [@elasticheart](https://discuss.elastic.co/u/elasticheart)\
**Post date:** [December 3, 2018, 11:11am UTC](https://discuss.elastic.co/t/how-to-write-a-watcher-with-match-term-aggregation-and-count/158551/3 "2018-12-03T11:11:53Z")

</div>

Hi @spinscale it has so many files. Which one are you pointing to?

Thanks.

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [December 3, 2018, 4:58pm UTC](https://discuss.elastic.co/t/how-to-write-a-watcher-with-match-term-aggregation-and-count/158551/4 "2018-12-03T16:58:19Z")

</div>

I suggest to go through the condition scripts of all the watches listed there, to get some more understanding.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 31, 2018, 4:58pm UTC](https://discuss.elastic.co/t/how-to-write-a-watcher-with-match-term-aggregation-and-count/158551/5 "2018-12-31T16:58:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.