# Need help with watcher

**URL:** <https://discuss.elastic.co/t/need-help-with-watcher/271755>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [April 30, 2021, 9:23am UTC](https://discuss.elastic.co/t/need-help-with-watcher/271755 "2021-04-30T09:23:02Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tatamata](https://avatars.discourse-cdn.com/v4/letter/t/aca169/32.png) [@Tatamata](https://discuss.elastic.co/u/Tatamata)\
**Post date:** [April 30, 2021, 9:23am UTC](https://discuss.elastic.co/t/need-help-with-watcher/271755/1 "2021-04-30T09:23:02Z")

</div>

I need some help with watcher below. It is working but in email that is send to me I receive 10 cases of connection that receive code 503. I’d like instead to get a total number of calls with 503 for each IP. For instance.  
IP 10.10.10.10 53 connection with release cause 503  
IP 10.10.10.20 53 connection with release cause 503  
And so on.

{  
"trigger": {  
"schedule": {  
"interval": "15m"  
}  
},  
"input": {  
"search": {  
"request": {  
"search\_type": "query\_then\_fetch",  
"indices": [  
"netnumber-titan\*"  
],  
"rest\_total\_hits\_as\_int": true,  
"body": {  
"query": {  
"bool": {  
"must": [  
{  
"match": {  
"REL\_CAUSE": "503"  
}  
},  
{  
"range": {  
"@timestamp": {  
"gte": "now-15m"  
}  
}  
}  
]  
}  
},  
"\_source": [  
"REL\_CAUSE",  
"@timestamp",  
"INGRESS\_IP"  
]  
}  
}  
}  
},  
"condition": {  
"compare": {  
"ctx.payload.hits.total": {  
"gt": 10  
}  
}  
},  
"actions": {  
"email\_users": {  
"email": {  
"profile": "standard",  
"to": [  
[my.email@myhouse.com](mailto:my.email@myhouse.com)  
],  
"subject": "{{ctx.payload.hits.total}} Kibana Watcher Alert: RELEASE CAUSE 503",  
"body": {  
"html": " **--{{ctx.payload.hits.total}} connections in last 15 minutes with release cause 503--** \n\n

{{#ctx.payload.hits.hits}}\n

IP {{\_source.INGRESS\_IP}}{{ctx.payload.hits.hits.0.\_source\_host}} ,time of occuarancy: {{\_source.@timestamp}}{{ctx.payload.hits.hits.0.\_source@timeframe}}\t{{\_source.REL\_CAUSE}}\n{{/ctx.payload.hits.hits}}"  
}  
}  
}  
},  
"throttle\_period\_in\_millis": 600000  
}

Result that I’m receiving today is  
IP 10.10.10.10 ,time of occuarancy: 2021-04-30T08:31:41.128Z 503  
IP 10.22.30.1 ,time of occuarancy: 2021-04-30T08:31:39.739Z 503  
IP 10.10.10.10 ,time of occuarancy: 2021-04-30T08:31:39.740Z 503  
IP 10.10.12.55 ,time of occuarancy: 2021-04-30T08:31:39.740Z 503  
IP 10.10.12.100 ,time of occuarancy: 2021-04-30T08:31:41.128Z 503  
IP 10.22.30.1,time of occuarancy: 2021-04-30T08:31:45.767Z 503  
IP 10.10.10.33 ,time of occuarancy: 2021-04-30T08:31:44.712Z 503  
IP 10.33.10.1 ,time of occuarancy: 2021-04-30T08:31:37.607Z 503  
IP 10.10.10.33 ,time of occuarancy: 2021-04-30T08:31:37.917Z 503  
IP 10.10.10.10 ,time of occuarancy: 2021-04-30T08:31:38.596Z 503  
Appreciate if somebody can help me or give me advice.

Expected result should look like  
IP 10.22.30.1 ,total number of connection with release code 503 in last 15 minutes is 11  
IP 10.10.10.10 , ,total number of connection with release code 503 in last 15 minutes is 23  
and so on for all IPs

Many thanks

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [May 10, 2021, 9:31am UTC](https://discuss.elastic.co/t/need-help-with-watcher/271755/2 "2021-05-10T09:31:13Z")

</div>

Please format your code properly, as this forum support markdown. Your snippet is rather hard to read 🙂

The basic idea for you query is that you are not interesting in single documents, but rather in aggregations of your search where you want to group by ip address.

This means you need to rethink your query and use [aggregations](https://www.elastic.co/guide/en/elasticsearch/reference/7.12/search-aggregations.html) to group by IP address (probably using a `terms` aggregation).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 7, 2021, 9:31am UTC](https://discuss.elastic.co/t/need-help-with-watcher/271755/3 "2021-06-07T09:31:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.