# Is Watcher stateful?
**URL:** https://discuss.elastic.co/t/is-watcher-stateful/56381
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [July 26, 2016, 10:13am UTC](https://discuss.elastic.co/t/is-watcher-stateful/56381 "2016-07-26T10:13:59Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@apoc](https://discuss.elastic.co/u/apoc)
#### Post date: [July 26, 2016, 10:13am UTC](https://discuss.elastic.co/t/is-watcher-stateful/56381/1 "2016-07-26T10:13:59Z")
Hi,
I have an event every minute stored in elastisearch.
I would like to monitor a field value. For example, if the field value increase by 10% in a timeframe, then an alert is triggered. Is it possible to do that with watcher ?
thank you for your help
--
Jeremy
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [July 26, 2016, 10:17am UTC](https://discuss.elastic.co/t/is-watcher-stateful/56381/2 "2016-07-26T10:17:17Z")
> [@apoc](#):
>
> if the field value increase by 10% in a timeframe, then an alert is triggered. Is it possible to do that with watcher ?
It's possible, [https://www.elastic.co/guide/en/watcher/current/watching-time-series-data.html](https://www.elastic.co/guide/en/watcher/current/watching-time-series-data.html) has some basic info on it.
---
### Author:  [@apoc](https://discuss.elastic.co/u/apoc)
#### Post date: [July 26, 2016, 10:42am UTC](https://discuss.elastic.co/t/is-watcher-stateful/56381/3 "2016-07-26T10:42:35Z")
Thank you Mark for your quick response 🙂
the example use the total hits in the condition. How to deal with field value change ? Compute the field value increase from older events ?
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [July 26, 2016, 2:17pm UTC](https://discuss.elastic.co/t/is-watcher-stateful/56381/4 "2016-07-26T14:17:00Z")
Hey,
your question is really broad and potentially hard to answer. If you mean by stateful, that it keeps previous watch executions in memory and compares former values from the responses, then the answer is `no`.
However, if you have an input in watcher that searches data, you can just search across several time windows (like the last 5 minutes and the last 5-10 minutes) and then compare those windows and check if the values of those time frames increased by 10% in a scripted condition.
I hope this helps, otherwise please refine your question and I'll try to answer 🙂
--Alex
---
### Author:  [@apoc](https://discuss.elastic.co/u/apoc)
#### Post date: [July 26, 2016, 3:37pm UTC](https://discuss.elastic.co/t/is-watcher-stateful/56381/5 "2016-07-26T15:37:16Z")
thank you Alex, that's exactly what I would like to do 🙂
But how to search accros several time windows ? Do you have an example ?
thank you
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [July 26, 2016, 4:39pm UTC](https://discuss.elastic.co/t/is-watcher-stateful/56381/6 "2016-07-26T16:39:19Z")
Hey,
just search through this forum and you will see a bunch of watches with aggregations to get the basic idea. Searching for 'aggregations filters' should also help. The documentation for the [filters agg](https://www.elastic.co/guide/en/elasticsearch/reference/2.3/search-aggregations-bucket-filters-aggregation.html#_anonymous_filters) should also help.
--Alex
---
### Author:  [@apoc](https://discuss.elastic.co/u/apoc)
#### Post date: [July 26, 2016, 8:24pm UTC](https://discuss.elastic.co/t/is-watcher-stateful/56381/7 "2016-07-26T20:24:08Z")
Will do that thank you Alex
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:44pm UTC](https://discuss.elastic.co/t/is-watcher-stateful/56381/8 "2017-07-06T13:44:13Z")