# Kibana X-Pack Watcher Problem

**URL:** <https://discuss.elastic.co/t/kibana-x-pack-watcher-problem/158916>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting\
**Created:** [November 30, 2018, 2:33pm UTC](https://discuss.elastic.co/t/kibana-x-pack-watcher-problem/158916 "2018-11-30T14:33:41Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![cemkuleyin](https://avatars.discourse-cdn.com/v4/letter/c/9d8465/32.png) [@cemkuleyin](https://discuss.elastic.co/u/cemkuleyin)\
**Post date:** [November 30, 2018, 2:33pm UTC](https://discuss.elastic.co/t/kibana-x-pack-watcher-problem/158916/1 "2018-11-30T14:33:41Z")

</div>

Hi everyone,

We want to subscribe xpack. Before the subscribe, we are testing it.

Our case,

we have a field of process status, we want to fired alarm for success rate. In field, "COMPLETE\_SUCCESS" and "AUTHENTICATION\_INIT" Our formula, count(COMPLETE\_SUCCESS)/count(authentication\_init).

Can you explain json format.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/1/e132061651a0640ff9cc4be8bc9876acc42e84e7.png)

---

<div class="post-metadata">

**Author:** ![bryan\_stuhlsatz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bryan_stuhlsatz/32/49123_2.png) [@bryan\_stuhlsatz](https://discuss.elastic.co/u/bryan_stuhlsatz)\
**Post date:** [December 2, 2018, 6:01am UTC](https://discuss.elastic.co/t/kibana-x-pack-watcher-problem/158916/2 "2018-12-02T06:01:01Z")

</div>

Json is a file format. You need to put your trigger, input, condition, etc, in that format for the watcher to execute. [https://www.elastic.co/guide/en/x-pack/current/how-watcher-works.html](https://www.elastic.co/guide/en/x-pack/current/how-watcher-works.html)

---

<div class="post-metadata">

**Author:** ![cemkuleyin](https://avatars.discourse-cdn.com/v4/letter/c/9d8465/32.png) [@cemkuleyin](https://discuss.elastic.co/u/cemkuleyin)\
**Post date:** [December 3, 2018, 7:17am UTC](https://discuss.elastic.co/t/kibana-x-pack-watcher-problem/158916/3 "2018-12-03T07:17:06Z")

</div>

thanks for reply.

I create some part of alert. But i dont create condition. i have a two search, first and second. i want to calculate **first/second (percentage) \< 50% .**

Can you examine this condition?

Kind Regards,

Cem

```
{

```

"trigger": {  
"schedule": {  
"interval": "10m"  
}  
},  
"input": {  
"chain": {  
"inputs": [  
{  
"first": {  
"search": {  
"request": {  
"indices": [  
"graylog\*"  
],  
"body": {  
"query": {  
"bool": {  
"must": [  
{  
"match": {  
"ctxt\_page\_name": "Thank You"  
}  
},  
{  
"range": {  
"timestamp": {  
"from": "now-5m",  
"to": "now"  
}  
}  
}  
]  
}  
}  
}  
}  
}  
}  
},  
{  
"second": {  
"search": {  
"request": {  
"indices": [  
"graylog\*"  
],  
"types": ,  
"body": {  
"query": {  
"bool": {  
"must": [  
{  
"match": {  
"ctxt\_page\_name": "Payment"  
}  
},  
{  
"range": {  
"timestamp": {  
"from": "now-5m",  
"to": "now"  
}  
}  
}  
]  
}  
}  
}  
}  
}  
}  
}  
]  
}  
},  
"condition": {  
"script": {  
"source": "return ((ctx.payload.first.hits.total / ctx.payload.second.hits.total)\*100) \< 50",  
"lang": "painless"  
}  
},  
"actions": {  
"email\_users": {  
"email": {  
"profile": "standard",  
"attachments": {  
"copy\_of\_search\_results.txt": {  
"data": {  
"format": "json"  
}  
}  
},  
"priority": "high",  
"to": [  
"cem.kuleyin@enuygun.com"  
],  
"subject": "ELASTIC STACK ALERT: Payment processing issues in Application!",  
"body": {  
"html": " **--Alerts Notification Details--**  
This alert triggered because a total of **{{ctx.payload.first.hits.total}}** timeout logs and **{{ctx.payload.second.hits.total}}** payment approvals were found in the application within the last ten minutes!  
  
**ALERT NAME:** {{ctx.watch\_id}}  
**Link to Kibana Dashboard:** [https://your.secure.link.here](https://your.secure.link.here)"  
}  
}  
}  
},  
"throttle\_period": "1h"  
}

---

<div class="post-metadata">

**Author:** ![cemkuleyin](https://avatars.discourse-cdn.com/v4/letter/c/9d8465/32.png) [@cemkuleyin](https://discuss.elastic.co/u/cemkuleyin)\
**Post date:** [December 4, 2018, 11:11am UTC](https://discuss.elastic.co/t/kibana-x-pack-watcher-problem/158916/4 "2018-12-04T11:11:24Z")

</div>

@bryan_stuhlsatz . please can you help me?

---

<div class="post-metadata">

**Author:** ![bryan\_stuhlsatz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bryan_stuhlsatz/32/49123_2.png) [@bryan\_stuhlsatz](https://discuss.elastic.co/u/bryan_stuhlsatz)\
**Post date:** [December 5, 2018, 5:42am UTC](https://discuss.elastic.co/t/kibana-x-pack-watcher-problem/158916/5 "2018-12-05T05:42:46Z")

</div>

Sorry, you don't explain your problem. At first, you state "Can you explain Json?" Now you have your watcher rule, and say "can you help me?" Please state the problem you are having.

---

<div class="post-metadata">

**Author:** ![cemkuleyin](https://avatars.discourse-cdn.com/v4/letter/c/9d8465/32.png) [@cemkuleyin](https://discuss.elastic.co/u/cemkuleyin)\
**Post date:** [December 10, 2018, 12:02pm UTC](https://discuss.elastic.co/t/kibana-x-pack-watcher-problem/158916/6 "2018-12-10T12:02:33Z")

</div>

im sorry. In our json, we are calculating two state, (first and second) i want to calculate first/second for alert. But i cannot calculate it.

is it enough for you? @bryan_stuhlsatz

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 7, 2019, 12:13pm UTC](https://discuss.elastic.co/t/kibana-x-pack-watcher-problem/158916/7 "2019-01-07T12:13:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.