# Setting up Watches

**URL:** https://discuss.elastic.co/t/setting-up-watches/128218
**Category:** Elasticsearch
**Created:** [April 16, 2018, 3:02pm UTC](https://discuss.elastic.co/t/setting-up-watches/128218 "2018-04-16T15:02:46Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![volksman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/volksman/32/30042_2.png) [@volksman](https://discuss.elastic.co/u/volksman)
#### Post date: [April 16, 2018, 3:02pm UTC](https://discuss.elastic.co/t/setting-up-watches/128218/1 "2018-04-16T15:02:47Z")

</div>

Hello! I'm fairly new to the stack but I have an ELK system setup and consuming logs from a production webserver. I'd like to setup some Watches. When I go to setup a Watch it asks for a name and index, so I provide a name and index (logstash-\*). But how do I define my query? For example I'd like to narrow things down by app\_id, type and then a condition (response code from server).

All I'm provided with is this:

 ![13](https://us1.discourse-cdn.com/elastic/original/3X/0/e/0ebbf83d5f5e394ea1671d58dc796ccc45919811.png)

So where do I set my query?

---

<div class="post-metadata">

### Author: ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [April 16, 2018, 3:21pm UTC](https://discuss.elastic.co/t/setting-up-watches/128218/2 "2018-04-16T15:21:12Z")

</div>

Hey,

you have selected to configure a threshold alert, which basically is a threshold above a certain aggregated value.

If you want to use a query, you need to write a watch yourself using the `Advanced watch` method. This means you are writing the watch yourself. The first thing you should take a look is probably [getting started with watcher](https://www.elastic.co/guide/en/x-pack/6.2/watcher-getting-started.html) and then the [search input](https://www.elastic.co/guide/en/x-pack/6.2/input-search.html)

hope this helps!

--Alex

---

<div class="post-metadata">

### Author: ![volksman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/volksman/32/30042_2.png) [@volksman](https://discuss.elastic.co/u/volksman)
#### Post date: [April 16, 2018, 3:26pm UTC](https://discuss.elastic.co/t/setting-up-watches/128218/3 "2018-04-16T15:26:36Z")

</div>

Ahh! So there is no UI component to select pieces and put together a watch. Was hopeful given that some of the SaaS solutions based on ELK have that. All good, will read!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 14, 2018, 3:26pm UTC](https://discuss.elastic.co/t/setting-up-watches/128218/4 "2018-05-14T15:26:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.