# Nodes joining or leaving the cluster **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-alerting\ **Created:** [June 23, 2016, 12:09am UTC](https://discuss.elastic.co/t/nodes-joining-or-leaving-the-cluster/53717 "2016-06-23T00:09:57Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![michael.mack](https://avatars.discourse-cdn.com/v4/letter/m/a698b9/32.png) [@michael.mack](https://discuss.elastic.co/u/michael.mack)\ **Post date:** [June 23, 2016, 12:09am UTC](https://discuss.elastic.co/t/nodes-joining-or-leaving-the-cluster/53717/1 "2016-06-23T00:09:58Z")
Starting in Elastic 2, the node event "node\_left" and "node\_joined" have been removed from marvel indexes. Is there any other way to create a watch to alert when a node joins or leaves the cluster? Besides doing a query for total nodes? ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [June 23, 2016, 7:42am UTC](https://discuss.elastic.co/t/nodes-joining-or-leaving-the-cluster/53717/2 "2016-06-23T07:42:12Z")
Hey, a couple of possibilities (tested with 5.0.0-alpha3): - data of the type `.monitoring/cluster_info` contains a node count (same for `cluster_stats`) - data of type `node` in the monitoring indices contain node information, albeit no timestamp to filter for - The type `node_stats` contains a timestamp and a node\_id/node name. This would allow you to execute one search with two aggregations for different time windows and aggregate on the node name. If the results differ, you can easily filter out the joined or left nodes using scripting hope this helps --Alex ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:44pm UTC](https://discuss.elastic.co/t/nodes-joining-or-leaving-the-cluster/53717/3 "2017-07-06T13:44:46Z")