# System status (Green, Yellow, Red) for specific watcher

**URL:** <https://discuss.elastic.co/t/system-status-green-yellow-red-for-specific-watcher/71710>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [January 16, 2017, 10:15am UTC](https://discuss.elastic.co/t/system-status-green-yellow-red-for-specific-watcher/71710 "2017-01-16T10:15:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Marek\_Leszczynski](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marek_leszczynski/32/14587_2.png) [@Marek\_Leszczynski](https://discuss.elastic.co/u/Marek_Leszczynski)\
**Post date:** [January 16, 2017, 10:15am UTC](https://discuss.elastic.co/t/system-status-green-yellow-red-for-specific-watcher/71710/1 "2017-01-16T10:15:33Z")

</div>

Hello,  
I'm setting up watchers in our system and I want to know if there is a possibility to recognize status (Green, Yellow, Red) for watcher.  
E.g  
If connection with some service went down and we will have 3 exceptions in last 5 minutes I want to send alert with status Yellow. Then if there will be 2 more I want to change status to Red. When connection came back I want to get email with Green status.

For now I set up watcher for monitoring connection with some service and it works but I'm wondering about those statuses.

I will be really happy if someone could help me with this.

Thanks

---

<div class="post-metadata">

**Author:** ![tanguy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tanguy/32/6030_2.png) [@tanguy](https://discuss.elastic.co/u/tanguy)\
**Post date:** [January 16, 2017, 11:25am UTC](https://discuss.elastic.co/t/system-status-green-yellow-red-for-specific-watcher/71710/2 "2017-01-16T11:25:34Z")

</div>

Hi,

This is not an easy one because you need to keep a kind of "state" around for your service.

You could define a watch A that checks every minute the status of your remote service. If OK, no action is executed (or maybe a log debug message). If not OK, the watch index a document in a dedicated index.

You could define another watch B that retrieves every minute the documents in the dedicated index for the last 5 minutes, in order. Then using a script it can iterate over these documents and sets the status of the email accordingly?

Note that the dedicated index must be cleaned up at some point. Also, Watcher can record the watch history so maybe you can query this one to retrieve the latest watch execution status instead of using a dedicated index.

---

<div class="post-metadata">

**Author:** ![Marek\_Leszczynski](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marek_leszczynski/32/14587_2.png) [@Marek\_Leszczynski](https://discuss.elastic.co/u/Marek_Leszczynski)\
**Post date:** [January 17, 2017, 10:27am UTC](https://discuss.elastic.co/t/system-status-green-yellow-red-for-specific-watcher/71710/3 "2017-01-17T10:27:57Z")

</div>

I like idea of using watch history. I'll try to set this up.  
Once I get this working I update this post with status 🙂

Thank you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 14, 2017, 10:28am UTC](https://discuss.elastic.co/t/system-status-green-yellow-red-for-specific-watcher/71710/4 "2017-02-14T10:28:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.