# Setup Elastic Watcher Alert to match two message strings in a log
**URL:** https://discuss.elastic.co/t/setup-elastic-watcher-alert-to-match-two-message-strings-in-a-log/326804
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [March 1, 2023, 7:50pm UTC](https://discuss.elastic.co/t/setup-elastic-watcher-alert-to-match-two-message-strings-in-a-log/326804 "2023-03-01T19:50:48Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@scott.godfrey](https://discuss.elastic.co/u/scott.godfrey)
#### Post date: [March 1, 2023, 7:50pm UTC](https://discuss.elastic.co/t/setup-elastic-watcher-alert-to-match-two-message-strings-in-a-log/326804/1 "2023-03-01T19:50:48Z")
I'm trying to setup an Elastic Watcher Alert that will scan a logfile and match 2 different messages in the log and then send an alert.
Sample Log
[2023-02-13 09:00:10.749 -05:00 INF] This is test 1
[2023-02-13 09:10:10.789 -05:00 INF] This is test 2
[2023-02-15 09:00:10.750 -05:00 INF] This is test 3
[2023-02-15 09:10:10.751 -05:00 INF] This is test 4
[2023-02-22 04:05:11.752 -05:00 INF] This is test 5
[2023-02-22 04:10:11.753 -05:00 INF] This is test 6
I want to search for "This is test 2" AND "This is test 4"
and then send an alert
Anyone have a watcher alert similar to this for reference?
---
### Author:  [@richcollier](https://discuss.elastic.co/u/richcollier)
#### Post date: [March 2, 2023, 3:11pm UTC](https://discuss.elastic.co/t/setup-elastic-watcher-alert-to-match-two-message-strings-in-a-log/326804/2 "2023-03-02T15:11:19Z")
How about this, for that data in an index named `testing` and the timestamp parsed out into a field called `@timestamp` and the message parsed into a field called `event`:
```auto
POST _watcher/watch/_execute
{
"watch": {
"trigger": {
"schedule": {
"interval": "1h"
}
},
"input": {
"search": {
"request": {
"indices": [
"testing"
],
"body": {
"query": {
"bool": {
"should": [
{
"match_phrase": {
"event": "This is test 4"
}
},
{
"match_phrase": {
"event": "This is test 1"
}
}
],
"filter": [
{
"range": {
"@timestamp": {
"gte": "now-1h"
}
}
}
]
}
}
}
}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gte": 2
}
}
},
"actions": {
"log": {
"logging": {
"text": """
Alert - matched for both conditions
"""
}
}
}
}
}
```
---
### Author:  [@scott.godfrey](https://discuss.elastic.co/u/scott.godfrey)
#### Post date: [March 2, 2023, 5:27pm UTC](https://discuss.elastic.co/t/setup-elastic-watcher-alert-to-match-two-message-strings-in-a-log/326804/3 "2023-03-02T17:27:24Z")
Thanks, what would be the JSON format for testing it via the Console with a GET testing/\_search?
---
### Author:  [@richcollier](https://discuss.elastic.co/u/richcollier)
#### Post date: [March 6, 2023, 1:09pm UTC](https://discuss.elastic.co/t/setup-elastic-watcher-alert-to-match-two-message-strings-in-a-log/326804/4 "2023-03-06T13:09:34Z")
That's an API call to Watcher's `_execute` endpoint, used for testing (the Watch isn't "saved"). Once you get it the way you want, you can then `PUT` the watch to save it.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 3, 2023, 1:10pm UTC](https://discuss.elastic.co/t/setup-elastic-watcher-alert-to-match-two-message-strings-in-a-log/326804/5 "2023-04-03T13:10:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.