# Up/Down Monitoring with Elastic
**URL:** https://discuss.elastic.co/t/up-down-monitoring-with-elastic/188966
**Category:** Beats
**Tags:** elastic-stack-alerting, heartbeat
**Created:** [July 4, 2019, 7:02pm UTC](https://discuss.elastic.co/t/up-down-monitoring-with-elastic/188966 "2019-07-04T19:02:17Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Cody\_Jackson](https://discuss.elastic.co/u/Cody_Jackson)
#### Post date: [July 4, 2019, 7:02pm UTC](https://discuss.elastic.co/t/up-down-monitoring-with-elastic/188966/1 "2019-07-04T19:02:17Z")
Hey everyone,
I'm currently working on migrating the functionality of an old element management system (Solarwinds) to Elastic/Heartbeat for monitoring and alerting of devices when they go down and come back up.
I've had a lot of success with Heartbeat for many different use cases, but in this case, I need to achieve alerting behavior from heartbeat that I'm having a bit of a problem implementing.
This is the required functionality I've been asked to replicate:
Heartbeat performs ICMP requests to each monitored device (Easy enough)
in watcher, If monitor.status is "down" but was "up" in the last poll, send an alert
in watcher, If monitor.status is up and the last poll was down, send an email stating that the device is now back up.
I've written an application that essentially does this for other environments, but the person requesting this behavior is determined to use Heartbeat and get this functionality out of it.
Does anyone have experiencing writing a Watcher alert that can accomplish this? I don't expect anyone to write this alert for me, I'd just like to know if anyone has done this in the past, and if it's worth it to add somewhat complex logic to a watcher alert instead of using a simple polling/emailing python script that uses Elastic as a back-end.
I sincerely appreciate any advice!
Edit: Just to throw out there, I've heard of this behavior being implemented by creating a watcher alert for a single host, in this case I'm monitoring thousands of devices so those solutions won't cut it =[
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [July 5, 2019, 7:52am UTC](https://discuss.elastic.co/t/up-down-monitoring-with-elastic/188966/2 "2019-07-05T07:52:08Z")
Welcome 😃
What about something like [https://github.com/elastic/examples/tree/master/Alerting/Sample%20Watches/new\_process\_started](https://github.com/elastic/examples/tree/master/Alerting/Sample%20Watches/new_process_started), just altering it to look for host status changes?
---
### Author:  [@Cody\_Jackson](https://discuss.elastic.co/u/Cody_Jackson)
#### Post date: [July 5, 2019, 3:56pm UTC](https://discuss.elastic.co/t/up-down-monitoring-with-elastic/188966/3 "2019-07-05T15:56:33Z")
Thank you so much Mark! This is precisely what I needed! 😃
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 2, 2019, 4:01pm UTC](https://discuss.elastic.co/t/up-down-monitoring-with-elastic/188966/4 "2019-08-02T16:01:07Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.