# Queries in Watcher **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-alerting\ **Created:** [November 3, 2015, 8:42am UTC](https://discuss.elastic.co/t/queries-in-watcher/33607 "2015-11-03T08:42:12Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![SuperPringles](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/superpringles/32/5303_2.png) [@SuperPringles](https://discuss.elastic.co/u/SuperPringles)\ **Post date:** [November 3, 2015, 8:42am UTC](https://discuss.elastic.co/t/queries-in-watcher/33607/1 "2015-11-03T08:42:12Z")
Hi there! I'm not yet well versed in Watcher and I was wondering something. If you look at Kibana you can query similar to SQL which grabs the specific data you need from Elasticsearch. For example: host = 178.62.170.190 status = 404 This should return all 404 statuses of the ip address listed above. Can you add a watch in Watcher with similar properties? I want to be able to setup a watch which looks for 404 statuses (or whatever) in a specific host. Is such a thing possible in Watcher at this point? Thanks for your time 😄 ---
**Author:** ![mvg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mvg/32/98890_2.png) [@mvg](https://discuss.elastic.co/u/mvg)\ **Post date:** [November 3, 2015, 9:36am UTC](https://discuss.elastic.co/t/queries-in-watcher/33607/2 "2015-11-03T09:36:54Z")
Yes, if host and status are properties on your logs then that is possible with watcher. I recommend checking out the getting started on how to do something similar: [https://www.elastic.co/guide/en/watcher/current/getting-started.html](https://www.elastic.co/guide/en/watcher/current/getting-started.html) ---
**Author:** ![SuperPringles](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/superpringles/32/5303_2.png) [@SuperPringles](https://discuss.elastic.co/u/SuperPringles)\ **Post date:** [November 3, 2015, 9:44am UTC](https://discuss.elastic.co/t/queries-in-watcher/33607/3 "2015-11-03T09:44:40Z")
Ah so you can then! I tried looking for an example such as this in the documentation but I couldn't find anything. I did find something called simple input and wondered if that would be something I could use. Going by the example under customizing watches: ``` "input" : { "simple" : { "color" : "red", "status" : "error", "count" : 3 } } ``` If I were to change it to ``` "input" : { "simple" : { "host" : "178.62.170.190", "status" : "404" } } ``` Would that work in the way I would want it to? If not, can you show me an example of how to do it correctly or point me to the section of the documentation where this is explained? Thanks 😄 ---
**Author:** ![SuperPringles](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/superpringles/32/5303_2.png) [@SuperPringles](https://discuss.elastic.co/u/SuperPringles)\ **Post date:** [November 5, 2015, 4:47am UTC](https://discuss.elastic.co/t/queries-in-watcher/33607/4 "2015-11-05T04:47:37Z")
Anyone? ---
**Author:** ![skearns](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/skearns/32/125945_2.png) [@skearns](https://discuss.elastic.co/u/skearns)\ **Post date:** [November 5, 2015, 1:05pm UTC](https://discuss.elastic.co/t/queries-in-watcher/33607/5 "2015-11-05T13:05:59Z")
I don't think the simple input will work for you. If you want to see how to create a watch based on a Kibana visualization, I suggest watching my webinar on the topic - I create a watch from a dashboard live and walk through the process 🙂 [https://www.elastic.co/webinars/watcher-practical-alerting-for-elasticsearch](https://www.elastic.co/webinars/watcher-practical-alerting-for-elasticsearch) ---
**Author:** ![SuperPringles](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/superpringles/32/5303_2.png) [@SuperPringles](https://discuss.elastic.co/u/SuperPringles)\ **Post date:** [November 5, 2015, 1:53pm UTC](https://discuss.elastic.co/t/queries-in-watcher/33607/6 "2015-11-05T13:53:19Z")
Sounds good! I will look into it! Do you perhaps have webinar regarding the Slack actions? ---
**Author:** ![SuperPringles](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/superpringles/32/5303_2.png) [@SuperPringles](https://discuss.elastic.co/u/SuperPringles)\ **Post date:** [November 12, 2015, 3:45pm UTC](https://discuss.elastic.co/t/queries-in-watcher/33607/7 "2015-11-12T15:45:16Z")
@skearns I looked at your webinar and it was very interesting indeed! Though I'm still a bit lost on how to query something. ``` PUT _watcher/watch/watcher_execution_duration_SLA { "trigger": { "schedule": { "interval": "10s" } }, "input": { "search": { "request": { "indices": [".watch_history-*"], "body": { "query": { "filtered": { "query": { "match_all": {} }, "filter": { "bool": { "must": [ { "range": { "result.exectution_time": { "gte": "now-1m" } } }] } } } }, "size": 0, "aggs": { "watcher_SLA": { "percentiles": { "field": "result.exectution_time", "keyed": false, "percents": [ 99 ] } } } } } }, "condition": { "compare": { "FIELD": { "gt": 0 } } }, "actions": { "log" : { "logging" : { "text" : "The Watcher SLA was exceeded at {{ctx.exectution_time}}" } } } } } ``` You are filtering for the execution time of watcher. What I would like is to look into the logstash-\* indice and filter for records with a specific URL or IP address and a condition to watch for which is also part off the record. This would be for example host and http.status. I'd imagine that I'd have to change the indices to ``` ["logstash-*"] ``` but what about the query and agg? Sorry if this seems too low level but I'm having somewhat of a hard time understanding the used syntax. ---
**Author:** ![skearns](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/skearns/32/125945_2.png) [@skearns](https://discuss.elastic.co/u/skearns)\ **Post date:** [November 12, 2015, 4:55pm UTC](https://discuss.elastic.co/t/queries-in-watcher/33607/8 "2015-11-12T16:55:01Z")
It sounds like you're making progress. In the video, I demonstrated how to start with a Kibana dashboard, then pick a visualization that has the data I want to query against, and look at the underlying query that powers that chart. Starting with that query, I trimmed it down to just the part of the query that was necessary for my Watch. I think you could take a similar approach here? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:48pm UTC](https://discuss.elastic.co/t/queries-in-watcher/33607/9 "2017-07-06T13:48:13Z")