# Problem with filebeat and watcher

**URL:** <https://discuss.elastic.co/t/problem-with-filebeat-and-watcher/163769>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [January 10, 2019, 3:24pm UTC](https://discuss.elastic.co/t/problem-with-filebeat-and-watcher/163769 "2019-01-10T15:24:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![marcandre](https://avatars.discourse-cdn.com/v4/letter/m/c4cdca/32.png) [@marcandre](https://discuss.elastic.co/u/marcandre)\
**Post date:** [January 10, 2019, 3:24pm UTC](https://discuss.elastic.co/t/problem-with-filebeat-and-watcher/163769/1 "2019-01-10T15:24:43Z")

</div>

Hello,

I have a strange issue where i created a watcher alert. It was working well since last friday. For some reason, now that watcher send alert regarding the same event from 2018-12-14. I deleted and recreated the same watcher without success.

---

<div class="post-metadata">

**Author:** ![marcandre](https://avatars.discourse-cdn.com/v4/letter/m/c4cdca/32.png) [@marcandre](https://discuss.elastic.co/u/marcandre)\
**Post date:** [January 10, 2019, 3:57pm UTC](https://discuss.elastic.co/t/problem-with-filebeat-and-watcher/163769/2 "2019-01-10T15:57:22Z")

</div>

> {  
> "trigger": {  
> "schedule": {  
> "interval": "1m"  
> }  
> },  
> "input": {  
> "search": {  
> "request": {  
> "search\_type": "query\_then\_fetch",  
> "indices": [  
> "filebeat-\*"  
> ],  
> "types": ,  
> "body": {  
> "query": {  
> "bool": {  
> "filter": [  
> {  
> "range": {  
> "@timestamp": {  
> "gte": "now-1m"  
> }  
> }  
> },  
> {  
> "match": {  
> "system.auth.sudo.user": "root"  
> }  
> },  
> {  
> "match": {  
> "source": "/var/log/secure"  
> }  
> }  
> ]  
> }  
> }  
> }  
> }  
> }  
> },  
> "condition": {  
> "compare": {  
> "ctx.payload.hits.total": {  
> "gt": 0  
> }  
> }  
> },  
> "actions": {  
> "notify-slack": {  
> "slack": {  
> "message": {  
> "from": "name",  
> "to": [  
> "#chat"  
> ],  
> "text": "Sudo was run on {{ctx.payload.hits.hits.0.\_source.beat.name}}",  
> "attachments": [  
> {  
> "color": "danger",  
> "title": "Sudo was run by {{ctx.payload.hits.hits.0.\_source.system.auth.user}}",  
> "text": "Command: {{ctx.payload.hits.hits.0.\_source.system.auth.sudo.command}}\n When: {{ctx.payload.hits.hits.0.\_source.system.auth.timestamp}}\n Where: {{ctx.payload.hits.hits.0.\_source.system.auth.hostname}}"  
> }  
> ]  
> }  
> }  
> }  
> }  
> }

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [January 11, 2019, 8:46am UTC](https://discuss.elastic.co/t/problem-with-filebeat-and-watcher/163769/3 "2019-01-11T08:46:10Z")

</div>

Hey,

please take the time to properly format your messages using code snippets. You can use markdown here and it will greatly simplify reading your watch.

Can you explain what you mean with 'created without success'? Do you get an error message back? Also can you share the response of trying to save this watch? It is super important to share both.

Also, what version of Elasticsearch are you using?

Thanks!

--Alex

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 8, 2019, 10:46am UTC](https://discuss.elastic.co/t/problem-with-filebeat-and-watcher/163769/4 "2019-02-08T10:46:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.