# Request - Create Monitor using Extraction Query for a index

**URL:** <https://discuss.elastic.co/t/request-create-monitor-using-extraction-query-for-a-index/218696>\
**Category:** Kibana\
**Created:** [February 11, 2020, 1:50am UTC](https://discuss.elastic.co/t/request-create-monitor-using-extraction-query-for-a-index/218696 "2020-02-11T01:50:10Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![anirudhkashikar](https://avatars.discourse-cdn.com/v4/letter/a/48db29/32.png) [@anirudhkashikar](https://discuss.elastic.co/u/anirudhkashikar)\
**Post date:** [February 11, 2020, 1:50am UTC](https://discuss.elastic.co/t/request-create-monitor-using-extraction-query-for-a-index/218696/1 "2020-02-11T01:50:10Z")

</div>

i am new to the tool and request some help. currently utilizing 6.8.

i was looking to create a monitor on field.meta.statusCode : 200, along with its corresponding message for a particular index. below is sample query where i am trying to identify message first, then add the statusCode field. currently i get only 2 hits, which is wrong, i was trying to extract both message and the code (eventually). please advise how to query accurately. the discover is simple. i am able to add the message and status code fields to identify the results. However, querying is a problem. thank you in advance.

{  
"version": true,  
"size": 0,  
"query": {  
"bool": {  
"must": [{  
"query\_string": {  
"query": "message",  
"analyze\_wildcard": true  
}  
},  
{  
"range": {  
"timestamp": {  
"from": "{{period\_end}}||-10m",  
"to": "{{period\_end}}",  
"include\_lower": true,  
"include\_upper": true,  
"boost": 1  
}  
}

---

<div class="post-metadata">

**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\
**Post date:** [February 12, 2020, 1:11pm UTC](https://discuss.elastic.co/t/request-create-monitor-using-extraction-query-for-a-index/218696/2 "2020-02-12T13:11:57Z")

</div>

It looks like you are using opendistro, please consider asking your question in the opendistro forum.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 11, 2020, 1:12pm UTC](https://discuss.elastic.co/t/request-create-monitor-using-extraction-query-for-a-index/218696/3 "2020-03-11T13:12:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.