# Monitoring shars count by watchers **URL:** \ **Category:** Kibana\ **Created:** [August 14, 2025, 2:32pm UTC](https://discuss.elastic.co/t/monitoring-shars-count-by-watchers/381050 "2025-08-14T14:32:17Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Cristina\_Marletta\_Li](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cristina_marletta_li/32/137793_2.png) [@Cristina\_Marletta\_Li](https://discuss.elastic.co/u/Cristina_Marletta_Li)\ **Post date:** [August 14, 2025, 2:32pm UTC](https://discuss.elastic.co/t/monitoring-shars-count-by-watchers/381050/1 "2025-08-14T14:32:17Z")
Hi all, Is it possible to monitor the number of shards per node using watchers? I would like to be able to trigger an alert when the result of the GET \_cat/allocation?v&h=node,shards returns, for at least one node, a value greater than 500. Thank you for your help. Cristina Marletta Livi ---
**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\ **Post date:** [August 14, 2025, 4:40pm UTC](https://discuss.elastic.co/t/monitoring-shars-count-by-watchers/381050/2 "2025-08-14T16:40:16Z")
Hello @Cristina_Marletta_Li Yes, it is possible using watcher. Below is just an example, you might have to update as per your requirement. ```auto { "trigger": { "schedule": { "interval": "1m" } }, "input": { "http": { "request": { "scheme": "https", "host": "elk-end-point", "port": 9243, "method": "get", "path": "/_cat/allocation", "params": { "format": "json", "h": "node,shards" }, "headers": {}, "auth": { "basic": { "username": "user", "password": "password" } } } } }, "condition": { "script": { "source": """ for (def entry : ctx.payload.data) { if (Integer.parseInt(entry.shards) > 500) { return true; } } return false; """, "lang": "painless" } }, "actions": { "log_alert": { "logging": { "level": "info", "text": "One or more nodes have more than 500 shards." } } } } ``` Thanks!! ---
**Author:** ![Cristina\_Marletta\_Li](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cristina_marletta_li/32/137793_2.png) [@Cristina\_Marletta\_Li](https://discuss.elastic.co/u/Cristina_Marletta_Li)\ **Post date:** [August 25, 2025, 12:19pm UTC](https://discuss.elastic.co/t/monitoring-shars-count-by-watchers/381050/3 "2025-08-25T12:19:58Z")
Thanks @Tortoise . I wonder: are there other, more advisable ways to monitor the number of shards via an alerting mechanism? A rule, for example. ---
**Author:** ![Cristina\_Marletta\_Li](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cristina_marletta_li/32/137793_2.png) [@Cristina\_Marletta\_Li](https://discuss.elastic.co/u/Cristina_Marletta_Li)\ **Post date:** [August 25, 2025, 2:42pm UTC](https://discuss.elastic.co/t/monitoring-shars-count-by-watchers/381050/4 "2025-08-25T14:42:36Z")
> [@Tortoise](#): > > ```auto > "headers": {}, > "auth": { > "basic": { > "username": "user", > "password": "password" > } > } > > ``` Hi @Tortoise , I tried your script. Running 'Simulate', I get a certificate error: `(certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target` How can I get over it? Thanks for your help Cristina ---
**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\ **Post date:** [August 27, 2025, 2:36am UTC](https://discuss.elastic.co/t/monitoring-shars-count-by-watchers/381050/5 "2025-08-27T02:36:39Z")
Hello @Cristina_Marletta_Li Other way is you can try to use synthetics in Kibana to monitor the URL & the output we capture is as below : ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/5/35a4e291617c52c142ac955b690eebfaa63e28b0.png) On the synthetics response you can use the regex to see if output of shards is greater \> 499 , on this automatically the synthetics will trigger alert : ```auto Response body contains : "shards":"(5\d{2}|[6-9]\d{2}|\d{4,})" ``` If you still plan to use Watcher please share what watcher you are using for which the error was shared? Thanks!! ---
**Author:** ![Cristina\_Marletta\_Li](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cristina_marletta_li/32/137793_2.png) [@Cristina\_Marletta\_Li](https://discuss.elastic.co/u/Cristina_Marletta_Li)\ **Post date:** [August 27, 2025, 12:08pm UTC](https://discuss.elastic.co/t/monitoring-shars-count-by-watchers/381050/6 "2025-08-27T12:08:33Z")
Hi Tortoise, this is my watcher definition: ```auto { "trigger": { "schedule": { "interval": "12h" } }, "input": { "http": { "request": { "scheme": "https", "host": "127.0.0.1", "port": 9200, "method": "get", "path": "/_cat/allocation", "params": { "h": "node,shards", "format": "json" }, "headers": {} } } }, "condition": { "script": { "source": "for (def entry : ctx.payload.data) {if (Integer.parseInt(entry.shards) > 500) {return true;}} return false;", "lang": "painless" } }, "actions": { "log_alert": { "logging": { "level": "info", "text": "One or more nodes have more than 500 shards." } } } } ``` the simulation returns: ```auto { "type": "s_s_l_handshake_exception", "reason": "(certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target" } ``` > The Elasticsearch configuration contains: > xpack.security.http.ssl: > enabled: true > keystore.path: certs/http.p12 > certificate\_authorities: certs/http\_ca.crt > > xpack.security.transport.ssl: > enabled: true > verification\_mode: certificate > keystore.path: certs/transport.p12 > truststore.path: certs/transport.p12 The curl test is ok: curl [https://127.0.0.1:9200](https://127.0.0.1:9200) (external, opens in a new tab or window) -v --cacert /etc/elasticsearch/certs/http\_ca.crt Trying 127.0.0.1:9200... Connected to 127.0.0.1 (127.0.0.1) port 9200 (#0) So, I don't understand where the mistake lies. ---
**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\ **Post date:** [August 28, 2025, 5:30am UTC](https://discuss.elastic.co/t/monitoring-shars-count-by-watchers/381050/7 "2025-08-28T05:30:00Z")
Hello @Cristina_Marletta_Li As per the post : > [@Watcher Http Input - PKIX path building failed](https://discuss.elastic.co/t/watcher-http-input-pkix-path-building-failed/348279/7): > > Hi @Rossana so yes as @yago82 Said, please look at these settings. You will need to set these in your elasticsearch.yml This is not as secure... xpack.http.ssl.verification\_mode: none or set the path to the CA... xpack.http.ssl.certificate\_authorities: ["/path/to/http\_ca.crt"] In the elasticsearch.yml we need to add below entry : ```auto If it is for testing environment can use below (not secure): xpack.http.ssl.verification_mode: none For Prod need to use below : xpack.http.ssl.certificate_authorities: ["/path/to/http_ca.crt"] ``` Documentation : [https://www.elastic.co/docs/reference/elasticsearch/configuration-reference/watcher-settings](https://www.elastic.co/docs/reference/elasticsearch/configuration-reference/watcher-settings) Thanks!! ---
**Author:** ![Cristina\_Marletta\_Li](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cristina_marletta_li/32/137793_2.png) [@Cristina\_Marletta\_Li](https://discuss.elastic.co/u/Cristina_Marletta_Li)\ **Post date:** [August 28, 2025, 12:22pm UTC](https://discuss.elastic.co/t/monitoring-shars-count-by-watchers/381050/8 "2025-08-28T12:22:57Z")
Hi @Tortoise , now it’all ok! Tnx so much. Just one more question: On which types of nodes should I configure watchers: hot nodes, masters, etc.? For example, email accounts and xpack.http.ssl.certificate\_authorities in elasticsearch.yml.