# @timestamp in .watcher.history-\*

**URL:** <https://discuss.elastic.co/t/timestamp-in-watcher-history/333322>\
**Category:** Kibana\
**Created:** [May 12, 2023, 3:39pm UTC](https://discuss.elastic.co/t/timestamp-in-watcher-history/333322 "2023-05-12T15:39:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![rorii](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rorii/32/133785_2.png) [@rorii](https://discuss.elastic.co/u/rorii)\
**Post date:** [May 12, 2023, 3:39pm UTC](https://discuss.elastic.co/t/timestamp-in-watcher-history/333322/1 "2023-05-12T15:39:43Z")

</div>

I am trying to visualise alerts metrics in Kibana. Since the results.actions are stored in an array, I am trying to query the watcher history and with watcher index action to create my own index where I can aggregate the data.  
I have written this query but since .watcher-history doesn't seem to have a @timestamp I can't give it a range.  
Do you have any suggestions on how to work around this problem? Or a better idea on how to visualise alert metrics in Kibana?

Thanks

```auto
GET .watcher-history-*/_search
{
  "size": 0,
  "query": {
    "exists": {
      "field": "result.actions"
    }
  },
  "aggs": {
    "WatchId": {
      "terms": {
        "field": "watch_id",
        "size": 23
      },
      "aggs": {
        "top_hit_status": {
          "top_hits": {
            "_source": {
              "includes": [
                "result.actions*"
              ]
            },
            "size": 100
          }
        }
      }
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\
**Post date:** [May 31, 2023, 11:38pm UTC](https://discuss.elastic.co/t/timestamp-in-watcher-history/333322/2 "2023-05-31T23:38:13Z")

</div>

> [@rorii](#):
>
> Since the results.actions are stored in an array, I am trying to query the watcher history and with watcher index action to create my own index where I can aggregate the data.

You shouldn't ever have to query a system index to meet a goal like this. I don't see why using the Watcher [index action](https://www.elastic.co/guide/en/elasticsearch/reference/current/actions-index.html) alone isn't enough: when the watch triggers, you can index whatever you want (metrics). Then, you can visualize the data you index. The important things: work off of an index that you control. Don't look to the system internals for this.

Would tracking your own metrics in an index action this be enough to "visualize alert metrics"?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 28, 2023, 11:39pm UTC](https://discuss.elastic.co/t/timestamp-in-watcher-history/333322/3 "2023-06-28T23:39:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.