# Watch for Login failure in windows events with watcher **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-alerting\ **Created:** [July 12, 2019, 3:49pm UTC](https://discuss.elastic.co/t/watch-for-login-failure-in-windows-events-with-watcher/190277 "2019-07-12T15:49:42Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![mancharagopan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mancharagopan/32/60266_2.png) [@mancharagopan](https://discuss.elastic.co/u/mancharagopan)\ **Post date:** [July 12, 2019, 3:49pm UTC](https://discuss.elastic.co/t/watch-for-login-failure-in-windows-events-with-watcher/190277/1 "2019-07-12T15:49:42Z")
I want to alert when there is some number of windows authentication failure events within certain period of time. Can somebody help me with the code? i am new to this. ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [August 1, 2019, 12:09pm UTC](https://discuss.elastic.co/t/watch-for-login-failure-in-windows-events-with-watcher/190277/2 "2019-08-01T12:09:48Z")
hey, maybe you can share what you tried so far? This would make it easier to guide you into a direction. From what I imagine, you need to execute a query that filters for events in the last few minutes and that are a login failure. For beginners you can use the total number of documents as an indicator if you want to trigger an alert. --Alex ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 29, 2019, 12:22pm UTC](https://discuss.elastic.co/t/watch-for-login-failure-in-windows-events-with-watcher/190277/3 "2019-08-29T12:22:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.