# Parametrized watch **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-alerting\ **Created:** [August 24, 2018, 9:23am UTC](https://discuss.elastic.co/t/parametrized-watch/145878 "2018-08-24T09:23:56Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![The](https://avatars.discourse-cdn.com/v4/letter/t/e36b37/32.png) [@The](https://discuss.elastic.co/u/The)\ **Post date:** [August 24, 2018, 9:23am UTC](https://discuss.elastic.co/t/parametrized-watch/145878/1 "2018-08-24T09:23:56Z")
I gather logs from 500 different devices (each separated with different id) and would like to create a watcher that detects when any of them stops sending data. I managed to create a watcher that does it for a single device and I put 500 watches using curl. But then I got an error that only limited number of watches can run at the same time. I am trying to create a single watch and execute it (even externally) with different device IDs to check for lack of messages. Is that possible to do? I am trying to alter some data in my JSON watch, but without success. Is there any way to change metadata while executing watch? Or can I use alternative input to change just part of the data instead of removing the whole predefined one? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [August 24, 2018, 9:31am UTC](https://discuss.elastic.co/t/parametrized-watch/145878/2 "2018-08-24T09:31:28Z")
You do not necessarily need one watch per host. If you instead create a chained watch similar to [this example](https://github.com/elastic/examples/tree/master/Alerting/Sample%20Watches/system_fails_to_provide_data) you can have one query that retrieves the IDs of all hosts that provided data e.g. within the last 1 hour and then compare this to a second query which retrieves a list of the hosts that provided data during the last x minutes. Then compare these sets to identify any host that has stopped sending data. This approach should scale and perform much better. ---
**Author:** ![The](https://avatars.discourse-cdn.com/v4/letter/t/e36b37/32.png) [@The](https://discuss.elastic.co/u/The)\ **Post date:** [August 24, 2018, 9:42am UTC](https://discuss.elastic.co/t/parametrized-watch/145878/3 "2018-08-24T09:42:23Z")
That's the elegant solution I was looking for 🙂 I wonder if I could create a fixed list of IDs I expect to receive data from and compare it with those that actually send data. In my case I still didn't receive data from few devices and would like to detect them too. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [August 24, 2018, 9:48am UTC](https://discuss.elastic.co/t/parametrized-watch/145878/4 "2018-08-24T09:48:28Z")
You could create a separate index where you store a document per host you expect to receive from and use that in an additional step. That could also allow you to mark hosts down for maintenance etc. ---
**Author:** ![Mojster](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mojster/32/21209_2.png) [@Mojster](https://discuss.elastic.co/u/Mojster)\ **Post date:** [August 29, 2018, 8:48am UTC](https://discuss.elastic.co/t/parametrized-watch/145878/5 "2018-08-29T08:48:17Z")
I'm thinking of implementing something like this on my own. But I have an idea to watch monitoring index. So I would be able to get if a beat is down, even if it hasn't had any data to send in the last 5 hours. ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [August 29, 2018, 12:46pm UTC](https://discuss.elastic.co/t/parametrized-watch/145878/6 "2018-08-29T12:46:48Z")
Hey @The, maintaining a fixed list can be tedious but is a valid solution in some cases. Alternatively you could run the same query for two different time windows use a terms aggregation to get the ids found and then compare those two lists - if a id is missing from the newer time windows, you know the host has not sent any data. --Alex ---
**Author:** ![elastock](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elastock/32/35672_2.png) [@elastock](https://discuss.elastic.co/u/elastock)\ **Post date:** [September 10, 2018, 1:18pm UTC](https://discuss.elastic.co/t/parametrized-watch/145878/7 "2018-09-10T13:18:05Z")
If you want to create a fixed list of IDs but not store them in an index .You can do it by using a stored script field. ``` POST _scripts/dat_super_script { "script": { "lang": "painless", "code": """def list_of_my_IDS = ["ID1","ID2","ID3"]; ---put some code here to compare theses IDs with the result found in the payload and return true or false ---; """ } } ``` And then in your watch , you have to use the stored script as conditon validator ``` "email_administrator": { "condition": { "script": { "stored": "dat_super_script" } }, ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 8, 2018, 1:18pm UTC](https://discuss.elastic.co/t/parametrized-watch/145878/8 "2018-10-08T13:18:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.