# Scheduled Watches not Triggering

**URL:** <https://discuss.elastic.co/t/scheduled-watches-not-triggering/162523>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [December 31, 2018, 3:05pm UTC](https://discuss.elastic.co/t/scheduled-watches-not-triggering/162523 "2018-12-31T15:05:14Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![ccampbell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ccampbell/32/15320_2.png) [@ccampbell](https://discuss.elastic.co/u/ccampbell)\
**Post date:** [December 31, 2018, 3:05pm UTC](https://discuss.elastic.co/t/scheduled-watches-not-triggering/162523/1 "2018-12-31T15:05:14Z")

</div>

I have 3 Scheduled Watches running on my 3-Node ES cluster. Since I took the nodes down for patching at the start of December, the watches no longer fire at 6 AM as scheduled. All three watches show the status of "Firing" and have since the server was restarted. I can use the test function to execute the watches and they perform as expected, but I would like to get these firing automatically again.

What steps can I take to troubleshoot this problem?

---

<div class="post-metadata">

**Author:** ![baz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/baz/32/5183_2.png) [@baz](https://discuss.elastic.co/u/baz)\
**Post date:** [January 4, 2019, 4:07pm UTC](https://discuss.elastic.co/t/scheduled-watches-not-triggering/162523/2 "2019-01-04T16:07:03Z")

</div>

Hi, sorry to hear watcher is not happy! what version of elasticsearch are you running? Can you get me the output of the watch history for these watches? Also can you get me the status of watcher, `GET _xpack/watcher/stats`? You may want to try to `_stop` and then `_start` watcher as well, if you have not yet.

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [January 7, 2019, 9:44am UTC](https://discuss.elastic.co/t/scheduled-watches-not-triggering/162523/3 "2019-01-07T09:44:19Z")

</div>

can you also report which version of Elasticsearch you are using?

Can you also share the watcher history if they have been triggered at all?

Thank you!

---

<div class="post-metadata">

**Author:** ![ccampbell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ccampbell/32/15320_2.png) [@ccampbell](https://discuss.elastic.co/u/ccampbell)\
**Post date:** [January 7, 2019, 4:49pm UTC](https://discuss.elastic.co/t/scheduled-watches-not-triggering/162523/4 "2019-01-07T16:49:16Z")

</div>

I've tried stopping and starting watcher this morning, which may have started executions again. I moved one of my scheduled reports to run at noon today to see if that executes as I expect. Thanks,

---

<div class="post-metadata">

**Author:** ![ccampbell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ccampbell/32/15320_2.png) [@ccampbell](https://discuss.elastic.co/u/ccampbell)\
**Post date:** [January 7, 2019, 4:52pm UTC](https://discuss.elastic.co/t/scheduled-watches-not-triggering/162523/5 "2019-01-07T16:52:46Z")

</div>

I'm using v6.4.0 (for the full stack). I looked at .watcher\_history and it looks like nothing had been triggered since my maintenance work on the cluster at the start of December. There were a few attempted executions like this:

```
watch_id:xJSF3zE-RBCV5j2uI5XEPA_kibana_version_mismatch node:Jwyj0hcGQeSlTvIUUXViAQ state:not_executed_already_queued trigger_event.type:schedule trigger_event.triggered_time:December 28th 2018, 08:42:51.319 trigger_event.schedule.scheduled_time:December 28th 2018, 08:42:51.124 messages:Watch is already queued in thread pool _id:xJSF3zE-RBCV5j2uI5XEPA_kibana_version_mismatch_04c8d92e-e7c8-4431-b694-1c8a1db37802-2018-12-28T13:42:51.319Z _type:doc _index:.watcher-history-9-2018.12.28 _score: -

```

But none of the other system watches seem to have executed. Since doing a stop and start on watcher, it looks like the system watches are executing so I'm waiting to see if the problem is resolved.

---

<div class="post-metadata">

**Author:** ![ccampbell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ccampbell/32/15320_2.png) [@ccampbell](https://discuss.elastic.co/u/ccampbell)\
**Post date:** [January 7, 2019, 5:44pm UTC](https://discuss.elastic.co/t/scheduled-watches-not-triggering/162523/6 "2019-01-07T17:44:43Z")

</div>

FYI -  
My test watch executed successfully now, so I'll see if the other watches run in the morning. Thanks for the simple guidance, I wasn't aware of how to stop and start watcher to get things running again.

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [January 8, 2019, 8:23am UTC](https://discuss.elastic.co/t/scheduled-watches-not-triggering/162523/7 "2019-01-08T08:23:42Z")

</div>

Hey,

we fixed an important issue regarding watch execution on 6.4.1 which might have been causing the behaviour you have been mentioning. I'd urge you to upgrade at least Elasticsearch to 6.4.1 and then check if the issue still happens.

The PR in question is [https://github.com/elastic/elasticsearch/pull/33167](https://github.com/elastic/elasticsearch/pull/33167)

--Alex

---

<div class="post-metadata">

**Author:** ![ccampbell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ccampbell/32/15320_2.png) [@ccampbell](https://discuss.elastic.co/u/ccampbell)\
**Post date:** [January 8, 2019, 3:47pm UTC](https://discuss.elastic.co/t/scheduled-watches-not-triggering/162523/8 "2019-01-08T15:47:20Z")

</div>

I have a partial success - the watch that I edited to adjust the execution time (to test yesterday) successfully executed as scheduled this morning, the other one that was scheduled for this morning did not run. I've tried editing a minor portion of the watch to see if resaving the watch will allow it to execute tomorrow morning.

---

<div class="post-metadata">

**Author:** ![ccampbell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ccampbell/32/15320_2.png) [@ccampbell](https://discuss.elastic.co/u/ccampbell)\
**Post date:** [January 8, 2019, 3:48pm UTC](https://discuss.elastic.co/t/scheduled-watches-not-triggering/162523/9 "2019-01-08T15:48:45Z")

</div>

Unfortunately I won't be able to do an upgrade on this system for a bit of time, we have too many more critical projects looming right now. I will try to get up to 6.5 as soon as I can manage the time.

---

<div class="post-metadata">

**Author:** ![ccampbell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ccampbell/32/15320_2.png) [@ccampbell](https://discuss.elastic.co/u/ccampbell)\
**Post date:** [January 14, 2019, 7:14pm UTC](https://discuss.elastic.co/t/scheduled-watches-not-triggering/162523/10 "2019-01-14T19:14:17Z")

</div>

This issue is resolved now. After stopping and starting Watcher, I needed to edit and save the watches that showed as "Firing" to get them to begin executing on schedule again.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 11, 2019, 7:14pm UTC](https://discuss.elastic.co/t/scheduled-watches-not-triggering/162523/11 "2019-02-11T19:14:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
