# Parameterize Watcher query string

**URL:** https://discuss.elastic.co/t/parameterize-watcher-query-string/43855
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [March 9, 2016, 5:21am UTC](https://discuss.elastic.co/t/parameterize-watcher-query-string/43855 "2016-03-09T05:21:08Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Rubaiyat\_Islam\_Sadat](https://avatars.discourse-cdn.com/v4/letter/r/958977/32.png) [@Rubaiyat\_Islam\_Sadat](https://discuss.elastic.co/u/Rubaiyat_Islam_Sadat)
#### Post date: [March 9, 2016, 5:21am UTC](https://discuss.elastic.co/t/parameterize-watcher-query-string/43855/1 "2016-03-09T05:21:09Z")

</div>

I am currently using Watcher and part of it is as follows.

.................  
"input" : {  
"search" : {  
"request" : {  
"indices" : ["\<logstash-{now/d}\>"],  
"body" : {  
"query" : {  
"filtered": {  
"query": {  
"query\_string": {  
"query": ""rd1\*.xml" OR "permissions\*.xml" OR "control\*.zip" AND  
level:ERROR",  
"analyze\_wildcard": true  
}  
},  
.......

What I would like to achieve is to parametric this part if possible.

"query": ""rd1\*.xml" OR "permissions\*.xml" OR "control\*.zip" AND  
level:ERROR"

For example, I have to add another pattern such as "main\*.zip", So that I can change the values of the search query, for example, I read the query string from a file and pass it to Watcher input. Any help is really appreciated.

---

<div class="post-metadata">

### Author: ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [March 9, 2016, 6:55am UTC](https://discuss.elastic.co/t/parameterize-watcher-query-string/43855/2 "2016-03-09T06:55:16Z")

</div>

Hey,

if you want to change the query, you have to update the watch - I do not see any simpler solution. You could potentially use a chained input and get the query string via a HTTP input from another source, but this sounds quite complicated to me.

If you really need to store the query in a file first, you could use a command line tool like `fswatch` to trigger a new curl call, that updates the watch in Elasticsearch.

Again this sounds kinda tedious, and it might be easier, to just update the watch from your application, depending on how much coupling you want to do in your application.

Hope this helps,

--Alex

---

<div class="post-metadata">

### Author: ![Rubaiyat\_Islam\_Sadat](https://avatars.discourse-cdn.com/v4/letter/r/958977/32.png) [@Rubaiyat\_Islam\_Sadat](https://discuss.elastic.co/u/Rubaiyat_Islam_Sadat)
#### Post date: [March 9, 2016, 7:23am UTC](https://discuss.elastic.co/t/parameterize-watcher-query-string/43855/3 "2016-03-09T07:23:29Z")

</div>

Thanks Alex for your quick reply. That's also what I have thought so far. The reason why I am looking for a solution is that I would like to create a Watcher template which might read from a file, for example, and change the query and contents of the file will be changed by other interested parties who are not direct users of Watcher. You are certainly right. It is easier to update the watch from the application.

Rubaiyat

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:46pm UTC](https://discuss.elastic.co/t/parameterize-watcher-query-string/43855/4 "2017-07-06T13:46:44Z")

</div>


