# Setting watch to "restored" status
**URL:** https://discuss.elastic.co/t/setting-watch-to-restored-status/72495
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [January 23, 2017, 2:50pm UTC](https://discuss.elastic.co/t/setting-watch-to-restored-status/72495 "2017-01-23T14:50:01Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@patrick.wall](https://discuss.elastic.co/u/patrick.wall)
#### Post date: [January 23, 2017, 2:50pm UTC](https://discuss.elastic.co/t/setting-watch-to-restored-status/72495/1 "2017-01-23T14:50:01Z")
Hi All,
I am wondering about a particular use case. I am using watcher to send a webhook to an external alert tracking mechanism when a watch condition is met. The external system receives the event and creates an incident ticket in our enterprise service desk. This is pretty easy to set up with watcher
Our policies dictate that when an alert ( in this case my watch ) is restored, the alerting system send a "stand down" event to the helpdesk which will close down the incident ticket. Since watches dont maintain an internal state over time, I'm wondering how to implement this.
Right now I am considering having two watches set up per condition, one for detecting "system down" events then another detecting "system ok" events. Each watch would send either the "system ok" or "system down" event to the same endpoint and update the ticket status accordingly.
To me this seems a bit kludgy and im wondering if anyone here has any thoughts on how to achieve this or has done something similar in their own implementation.
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [January 24, 2017, 8:12am UTC](https://discuss.elastic.co/t/setting-watch-to-restored-status/72495/2 "2017-01-24T08:12:43Z")
Hey,
this is indeed a bit clunky at the moment, we intend to improve this by being able to access data from the previous watch runs in the context in the future. What you could do now
- Have two watches
- Use actions with `conditions`, see [this example](https://www.elastic.co/guide/en/x-pack/5.1/actions.html#CO44-2)
The latter one depends of course - if you always want to sent a `back up` event or only after somethign was down.
--Alex
---
### Author:  [@patrick.wall](https://discuss.elastic.co/u/patrick.wall)
#### Post date: [January 24, 2017, 6:52pm UTC](https://discuss.elastic.co/t/setting-watch-to-restored-status/72495/3 "2017-01-24T18:52:30Z")
Thanks! I think a conditional action might work for me in this case.
---
### Author:  [@patrick.wall](https://discuss.elastic.co/u/patrick.wall)
#### Post date: [January 25, 2017, 3:57pm UTC](https://discuss.elastic.co/t/setting-watch-to-restored-status/72495/4 "2017-01-25T15:57:13Z")
Is there a version where using conditions within an action became available? I am using elasticsearch 2.2 and receiving the error - "unknown action type [condition]"
my action looks like this
"actions": {
"notify-system-down": {
"condition": {
"compare": { "ctx.payload.aggregations.average-response-time.value" : { "gt" : 100000 }}
},
"webhook": {
"method": "POST",
"host": "",
"port": 4019,
"path": "/eventlistener/createEvent",
"headers": {
"Content-Type": "text/xml"
},
"body": ""
}
}
}
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [January 25, 2017, 5:15pm UTC](https://discuss.elastic.co/t/setting-watch-to-restored-status/72495/5 "2017-01-25T17:15:08Z")
Hey,
this was introduced in Elasticsearch 5.1. See the respective [release notes](https://www.elastic.co/guide/en/x-pack/5.1/xpack-release-notes.html)
--Alex
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 22, 2017, 5:15pm UTC](https://discuss.elastic.co/t/setting-watch-to-restored-status/72495/6 "2017-02-22T17:15:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.