# Multiple queries - action on second query if not met after x timeframe

**URL:** <https://discuss.elastic.co/t/multiple-queries-action-on-second-query-if-not-met-after-x-timeframe/179815>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [May 6, 2019, 4:55pm UTC](https://discuss.elastic.co/t/multiple-queries-action-on-second-query-if-not-met-after-x-timeframe/179815 "2019-05-06T16:55:31Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![lgordnier](https://avatars.discourse-cdn.com/v4/letter/l/ce7236/32.png) [@lgordnier](https://discuss.elastic.co/u/lgordnier)\
**Post date:** [May 6, 2019, 4:55pm UTC](https://discuss.elastic.co/t/multiple-queries-action-on-second-query-if-not-met-after-x-timeframe/179815/1 "2019-05-06T16:55:31Z")

</div>

Forgive me if this is already answered somewhere else on this forum, but I haven't had much luck finding it.

I'm trying to create a watcher to check for events (ie: down node). From within this watcher, i ONLY want to make an event if I haven't received a second event with a specific response within x time.

ex:  
look messages related to node "test" - search for the "disconnect" message. if I don't receive a "cleared" message for this same node within 15 minutes of receiving the disconnect - do an action.

my start point thus far:

```
{
  "trigger": {
    "schedule": {
      "interval": "30m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 10000,
          "query": {
            "bool": {
              "must": [
                {
                  "match_phrase": {
                    "message.alarmType": {
                      "query": "disconnect"
                    }
                  }
                },
                {
                  "match_phrase": {
                    "message.alarmKey": {
                      "query": "DEVICE_NAME"
                    }
                  }
                },
                {
                  "range": {
                    "@timestamp": {
                      "format": "strict_date_optional_time",
                      "gte": "now-30m"
                    }
                  }
                }
              ],
              "filter": [
                {
                  "match_all": {}
                }
              ],
              "should": [],
              "must_not": [
                {
                  "match_phrase": {
                    "message.alarmClass": {
                      "query": "cleared"
                    }
                  }
                }
              ]
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gte": 10
      }
    }
  },
  "actions": {
    "my-logging-action": {
      "logging": {
        "level": "info",
        "text": "There are {{ctx.payload.hits.total}} documents in your index. Threshold is 10."
      }
    }
  }
}
```

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [May 7, 2019, 9:41am UTC](https://discuss.elastic.co/t/multiple-queries-action-on-second-query-if-not-met-after-x-timeframe/179815/2 "2019-05-07T09:41:37Z")

</div>

you can use the [chain input](https://www.elastic.co/guide/en/elastic-stack-overview/7.0/input-chain.html) to execute multiple queries as an input for a watch.

Another idea would be to execute a query with aggregations. One aggregation would aggregate on DOWN events and hostnames and another on UP events an hostnames. This way you could check which hostnames are only in the DOWN section and thus knew, that there was no up event.

Would that make sense?

--Alex

---

<div class="post-metadata">

**Author:** ![lgordnier](https://avatars.discourse-cdn.com/v4/letter/l/ce7236/32.png) [@lgordnier](https://discuss.elastic.co/u/lgordnier)\
**Post date:** [May 7, 2019, 12:34pm UTC](https://discuss.elastic.co/t/multiple-queries-action-on-second-query-if-not-met-after-x-timeframe/179815/3 "2019-05-07T12:34:09Z")

</div>

Thanks for the ideas Alex, I'll give them a shot!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 4, 2019, 12:44pm UTC](https://discuss.elastic.co/t/multiple-queries-action-on-second-query-if-not-met-after-x-timeframe/179815/4 "2019-06-04T12:44:38Z")

</div>

Closed on June 4, 2019, 12:44pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.