# Relationship between watches

**URL:** <https://discuss.elastic.co/t/relationship-between-watches/88967>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [June 12, 2017, 3:16am UTC](https://discuss.elastic.co/t/relationship-between-watches/88967 "2017-06-12T03:16:53Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![abpabab](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abpabab/32/20905_2.png) [@abpabab](https://discuss.elastic.co/u/abpabab)\
**Post date:** [June 12, 2017, 3:16am UTC](https://discuss.elastic.co/t/relationship-between-watches/88967/1 "2017-06-12T03:16:53Z")

</div>

I wanna do alert in escalation way, for example:

1. In last 1 minute, my watch found 3 events met the condition, occurs on OBJECT\_A. So this watch marked with priority level is 1.
2. In next firing, my watch found more 3 events occurs on OBJECT\_A, same as last watch. \<== In here, my alert priority will be in level 2, and send the actual webhook action.

I'm using webhook, so I can solve this by coding the escalation engine in my webhook service, but I want to know how to do this by Elasticsearch and Watcher, is it possible?

---

<div class="post-metadata">

**Author:** ![bohyun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bohyun/32/10087_2.png) [@bohyun](https://discuss.elastic.co/u/bohyun)\
**Post date:** [June 12, 2017, 3:43am UTC](https://discuss.elastic.co/t/relationship-between-watches/88967/2 "2017-06-12T03:43:29Z")

</div>

Hi @abpabab

It sounds like you can achieve this by checking to see if 3 events met the condition in {now-1m} && 3 events met the condition between {now-2m} and {now-1m} and if it evaluates to true, fire a webhook action.

Thanks,  
Bohyun

---

<div class="post-metadata">

**Author:** ![abpabab](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abpabab/32/20905_2.png) [@abpabab](https://discuss.elastic.co/u/abpabab)\
**Post date:** [June 12, 2017, 4:06am UTC](https://discuss.elastic.co/t/relationship-between-watches/88967/3 "2017-06-12T04:06:44Z")

</div>

Ah ha, it's very simple and great.

In the case my watch found multiple OBJECT met the condition. Assume that are the IP addresses, so I need to iterate every IP address to find if I see it between {now-2m} and {now-1m} to generate exactly result.

What my watch looks like and what is the related documents?

Best regards.

---

<div class="post-metadata">

**Author:** ![abpabab](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abpabab/32/20905_2.png) [@abpabab](https://discuss.elastic.co/u/abpabab)\
**Post date:** [June 12, 2017, 4:37am UTC](https://discuss.elastic.co/t/relationship-between-watches/88967/4 "2017-06-12T04:37:20Z")

</div>

I found the example [here](https://github.com/elastic/examples/blob/master/Alerting/new_process_started/watch.json) on watcher example github repo.

Thank your for the support.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 10, 2017, 4:37am UTC](https://discuss.elastic.co/t/relationship-between-watches/88967/5 "2017-07-10T04:37:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.