# Setting up a watcher is seems harder than it should be **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-monitoring, elastic-stack-alerting\ **Created:** [December 8, 2020, 8:28pm UTC](https://discuss.elastic.co/t/setting-up-a-watcher-is-seems-harder-than-it-should-be/258046 "2020-12-08T20:28:10Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![mc1392](https://avatars.discourse-cdn.com/v4/letter/m/57b2e6/32.png) [@mc1392](https://discuss.elastic.co/u/mc1392)\ **Post date:** [December 8, 2020, 8:28pm UTC](https://discuss.elastic.co/t/setting-up-a-watcher-is-seems-harder-than-it-should-be/258046/1 "2020-12-08T20:28:10Z")
1 I used the following command to enable Watcher: ` PUT _cluster/settings { "persistent": { "xpack.monitoring.collection.enabled": true } }` When I goto the Watcher to create a watcher, there is no timestamp field. Do I have to create it manually? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [December 8, 2020, 9:29pm UTC](https://discuss.elastic.co/t/setting-up-a-watcher-is-seems-harder-than-it-should-be/258046/2 "2020-12-08T21:29:13Z")
Why did you think you needed to set that setting? > [@mc1392](#): > > When I goto the Watcher to create a watcher, there is no timestamp field. Do I have to create it manually? What are you creating a watch on? What does it look like? What does the source index look like? ---
**Author:** ![mc1392](https://avatars.discourse-cdn.com/v4/letter/m/57b2e6/32.png) [@mc1392](https://discuss.elastic.co/u/mc1392)\ **Post date:** [December 8, 2020, 10:51pm UTC](https://discuss.elastic.co/t/setting-up-a-watcher-is-seems-harder-than-it-should-be/258046/3 "2020-12-08T22:51:32Z")
when I ran: `GET _cluster/settings` The setting was set to false.So, I set it to true. That's what the docs said to do. As far as what alert I want, I just want to get anything going, I've never used it before. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [December 8, 2020, 10:52pm UTC](https://discuss.elastic.co/t/setting-up-a-watcher-is-seems-harder-than-it-should-be/258046/4 "2020-12-08T22:52:28Z")
Ok no worries! It's still not clear what you want to be alerted on here. What is the data source? ---
**Author:** ![mc1392](https://avatars.discourse-cdn.com/v4/letter/m/57b2e6/32.png) [@mc1392](https://discuss.elastic.co/u/mc1392)\ **Post date:** [December 8, 2020, 10:53pm UTC](https://discuss.elastic.co/t/setting-up-a-watcher-is-seems-harder-than-it-should-be/258046/5 "2020-12-08T22:53:12Z")
a few weeks ago we had an outage. I'd like to test CPU threshold, or even uptime...is the system available at all? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [December 8, 2020, 10:53pm UTC](https://discuss.elastic.co/t/setting-up-a-watcher-is-seems-harder-than-it-should-be/258046/6 "2020-12-08T22:53:58Z")
Makes sense. How are you sending this data to Elasticsearch, are you using Beats? Or are you specifically looking to alert on the data Elasticsearch collects on itself? ---
**Author:** ![mc1392](https://avatars.discourse-cdn.com/v4/letter/m/57b2e6/32.png) [@mc1392](https://discuss.elastic.co/u/mc1392)\ **Post date:** [December 8, 2020, 11:10pm UTC](https://discuss.elastic.co/t/setting-up-a-watcher-is-seems-harder-than-it-should-be/258046/7 "2020-12-08T23:10:33Z")
I'm using the Cloud. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [December 8, 2020, 11:12pm UTC](https://discuss.elastic.co/t/setting-up-a-watcher-is-seems-harder-than-it-should-be/258046/8 "2020-12-08T23:12:30Z")
You need to be a little more explicit please. What Cloud? CPU/uptime etc is a concept, but we need to translate that to an actual datasource that you want to generate alerts on. ---
**Author:** ![mc1392](https://avatars.discourse-cdn.com/v4/letter/m/57b2e6/32.png) [@mc1392](https://discuss.elastic.co/u/mc1392)\ **Post date:** [December 8, 2020, 11:14pm UTC](https://discuss.elastic.co/t/setting-up-a-watcher-is-seems-harder-than-it-should-be/258046/9 "2020-12-08T23:14:21Z")
I amusing the Elastic Cloud Service. I want to know when users cannot get any data from the cluster. We exposed the service to the web in the form of a search engine. I want ti know when my web app cannot get any data for reasons on the Elastic side. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [December 9, 2020, 6:52am UTC](https://discuss.elastic.co/t/setting-up-a-watcher-is-seems-harder-than-it-should-be/258046/10 "2020-12-09T06:52:05Z")
That is something I suspect you will need to monitor from outside the cluster. If the cluster for some reason was to end up in trouble and not being able to serve requests it may not be able to run Watcher either meaning you would not get any alert. I would also recommend against exposing your cluster directly to the internet as you may open yourself up to DDOS attacks or other activities. ---
**Author:** ![mc1392](https://avatars.discourse-cdn.com/v4/letter/m/57b2e6/32.png) [@mc1392](https://discuss.elastic.co/u/mc1392)\ **Post date:** [December 9, 2020, 4:29pm UTC](https://discuss.elastic.co/t/setting-up-a-watcher-is-seems-harder-than-it-should-be/258046/11 "2020-12-09T16:29:47Z")
so I should rely on the Observability Cluster? FYI: Our Elastic is hidden behind a web service, not totally public. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 6, 2021, 4:29pm UTC](https://discuss.elastic.co/t/setting-up-a-watcher-is-seems-harder-than-it-should-be/258046/12 "2021-01-06T16:29:55Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.