# Incorporating search query into watcher
**URL:** https://discuss.elastic.co/t/incorporating-search-query-into-watcher/86334
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [May 18, 2017, 9:12pm UTC](https://discuss.elastic.co/t/incorporating-search-query-into-watcher/86334 "2017-05-18T21:12:04Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@stecino](https://discuss.elastic.co/u/stecino)
#### Post date: [May 18, 2017, 9:12pm UTC](https://discuss.elastic.co/t/incorporating-search-query-into-watcher/86334/1 "2017-05-18T21:12:04Z")
I have the following query:
{
"aggs": {
"1": {
"date\_range": {
"field": "@timestamp",
"ranges": [
{
"from": "now-5m",
"to": "now"
}
]
}
}
},
"query" : {
"match": {
"access": {
"query": "ssl\_req",
"type": "phrase"
}
}
}
}
when I execute this via curl
curl -XGET [http://localhost:9201/\/\_search?pretty](http://localhost:9201/%3Cf5-%7Bnow%2Fd%7BYYYY.MM.dd%7D%7D%3E/_search?pretty) -d
it returns me the result with the aggregation at the end
"aggregations" : {
"1" : {
"buckets" : [ {
"key" : "2017-05-18T21:04:37.303Z-2017-05-18T21:09:37.303Z",
"from" : 1.495141477303E12,
"from\_as\_string" : "2017-05-18T21:04:37.303Z",
"to" : 1.495141777303E12,
"to\_as\_string" : "2017-05-18T21:09:37.303Z",
"doc\_count" : 2207
} ]
}
}
}
My questions are the following:
1. How can I include the index name into my query, so it runs that same index all the time
2. How can merge all this into a watcher
3. How can I extract the doc\_count and send out an email if it's \> 0 in watcher
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [May 19, 2017, 7:16am UTC](https://discuss.elastic.co/t/incorporating-search-query-into-watcher/86334/2 "2017-05-19T07:16:02Z")
Hey,
please take the time to format your message properly. Otherwise it is really hard to read.
Also, you should take a look at the watcher documentation, which contains a very similar example for monitoring [meetup.com](http://meetup.com) data. You can check the [documentation right here](https://www.elastic.co/guide/en/x-pack/5.4/watching-meetup-data.html).
--Alex
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 16, 2017, 7:16am UTC](https://discuss.elastic.co/t/incorporating-search-query-into-watcher/86334/3 "2017-06-16T07:16:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.