# Need help with a watch

**URL:** <https://discuss.elastic.co/t/need-help-with-a-watch/28171>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [August 27, 2015, 11:38am UTC](https://discuss.elastic.co/t/need-help-with-a-watch/28171 "2015-08-27T11:38:59Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![rvalta](https://avatars.discourse-cdn.com/v4/letter/r/51bf81/32.png) [@rvalta](https://discuss.elastic.co/u/rvalta)\
**Post date:** [August 27, 2015, 11:38am UTC](https://discuss.elastic.co/t/need-help-with-a-watch/28171/1 "2015-08-27T11:38:59Z")

</div>

Hi, I am trying to create a watch script that alerts me once when I get \> 100 http response 404 status codes in my logs during a 5 minute timeframe.

At the moment my script looks like this: [http://hastebin.com/okorulesuc.vhdl](http://hastebin.com/okorulesuc.vhdl)

The problem is that at the moment it alerts me every time the watch sees a 400 response code in a log event. Can someone help me, thank you? 😄

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:48pm UTC](https://discuss.elastic.co/t/need-help-with-a-watch/28171/2 "2017-07-06T13:48:49Z")

</div>