# Query for a new entry on a field

**URL:** <https://discuss.elastic.co/t/query-for-a-new-entry-on-a-field/239296>\
**Category:** Elasticsearch\
**Created:** [June 30, 2020, 12:34pm UTC](https://discuss.elastic.co/t/query-for-a-new-entry-on-a-field/239296 "2020-06-30T12:34:13Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ginu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ginu/32/86297_2.png) [@ginu](https://discuss.elastic.co/u/ginu)\
**Post date:** [June 30, 2020, 12:34pm UTC](https://discuss.elastic.co/t/query-for-a-new-entry-on-a-field/239296/1 "2020-06-30T12:34:13Z")

</div>

Hi  
I have an index which contains a field network\_device\_ID  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/f/afda508e8eab7bef6e7bf6ac560620e37d1b36f6.png)

I want to alert whenever there a new entry coming into the Index. what is the best way to achieve this?

Cheers, Ginu

---

<div class="post-metadata">

**Author:** ![defalt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/defalt/32/71379_2.png) [@defalt](https://discuss.elastic.co/u/defalt)\
**Post date:** [June 30, 2020, 1:49pm UTC](https://discuss.elastic.co/t/query-for-a-new-entry-on-a-field/239296/2 "2020-06-30T13:49:39Z")

</div>

Have a look at the free [Elast Alert](https://github.com/Yelp/elastalert) or the premium feature of [kibana](https://www.elastic.co/guide/en/kibana/7.x/alerting-getting-started.html).

---

<div class="post-metadata">

**Author:** ![ginu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ginu/32/86297_2.png) [@ginu](https://discuss.elastic.co/u/ginu)\
**Post date:** [June 30, 2020, 2:10pm UTC](https://discuss.elastic.co/t/query-for-a-new-entry-on-a-field/239296/3 "2020-06-30T14:10:28Z")

</div>

Hi Defalt  
thanks for the suggestion. but my question was more about how to cache the value which is already existing and only to alert the new Values coming in using Watchers.

in the example:  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/f/afda508e8eab7bef6e7bf6ac560620e37d1b36f6.png)

when there is a new network\_device\_id shows up. I want to alert.

Regards, Ginu

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 28, 2020, 2:10pm UTC](https://discuss.elastic.co/t/query-for-a-new-entry-on-a-field/239296/4 "2020-07-28T14:10:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.