# Watcher advanced

**URL:** <https://discuss.elastic.co/t/watcher-advanced/182352>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [May 23, 2019, 6:19am UTC](https://discuss.elastic.co/t/watcher-advanced/182352 "2019-05-23T06:19:15Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![AndreasJA](https://avatars.discourse-cdn.com/v4/letter/a/34f0e0/32.png) [@AndreasJA](https://discuss.elastic.co/u/AndreasJA)\
**Post date:** [May 23, 2019, 6:19am UTC](https://discuss.elastic.co/t/watcher-advanced/182352/1 "2019-05-23T06:19:15Z")

</div>

Hello to all, i want to use the watcher advanced but i am struggling with the syntax.  
For example i want to see if there is any traffic on a specific port from a specific host.  
The syntax itself should be right, but i do not get what i want...

The interval time is 5m, but i see in the visualization the last 15 minutes is no traffic.  
Does anybody know more how to configure my behaviour ?

"input": {  
"search": {  
"request": {  
"search\_type": "query\_then\_fetch",  
"indices": [  
"myindices-\*"  
],  
"types": ,  
"body": {  
"size": 0,  
"query": {  
"bool": {  
"should": [  
{  
"match\_phrase": {  
"beat.hostname": "myhostname"  
}  
},  
{  
"match\_phrase": {  
"port": "9444"  
}  
}  
]  
}  
}  
}  
}  
}  
},  
"condition": {  
"compare": {  
"ctx.payload.hits.total": {  
"eq": 0  
}  
}  
},

---

<div class="post-metadata">

**Author:** ![Jasonespo](https://avatars.discourse-cdn.com/v4/letter/j/898d66/32.png) [@Jasonespo](https://discuss.elastic.co/u/Jasonespo)\
**Post date:** [May 23, 2019, 2:28pm UTC](https://discuss.elastic.co/t/watcher-advanced/182352/2 "2019-05-23T14:28:08Z")

</div>

Hi, try this. Hope it helps 🙂 Set your interval to be whatever you want the trigger period to be. And set the window\_period to be the over what period of time you want to look for it.

```
{
  "trigger": {
    "schedule": {
      "interval": "5m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "myindices-*"
        ],
        "types": [],
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "should": [
                {
                  "term": {
                    "port": "9444"
                  }
                },
                {
                  "term": {
                    "beat.hostname": "myhostname"
                  }
                }
              ],
              "filter": [
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-{{ctx.metadata.window_period}}"
                    }
                  }
                }
              ]
            }
          },
          "aggs": {
            "events": {
              "top_hits": {
                "size": 100,
                "_source": [
                  "@timestamp",
                  "beat.hostname",
                  "port",
                  "_id"
                ]
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "script": {
      "inline": "return ctx.payload.hits.total >= 1"
    }
  },
  "metadata": {
    "window_period": "5m"
  },
  "throttle_period_in_millis": 120000
}
```

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [May 28, 2019, 8:45am UTC](https://discuss.elastic.co/t/watcher-advanced/182352/3 "2019-05-28T08:45:21Z")

</div>

Hey,

without seeing the output of a watch execution, debugging this will be super hard, so we need the output of the execute watch api.

Also, in order to simplify debugging, I highly encourage you to take a look at [this blogpost](https://www.elastic.co/blog/watching-the-watches-writing-debugging-and-testing-watches), which shows what you can do to simplify debugging of watches.

One last thing: The should query you are using actually becomes an OR query, you might want to use a `filter` part instead like Jason showed.

--Alex

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 25, 2019, 8:45am UTC](https://discuss.elastic.co/t/watcher-advanced/182352/4 "2019-06-25T08:45:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.