# Watcher advise in searching and filtering

**URL:** <https://discuss.elastic.co/t/watcher-advise-in-searching-and-filtering/174375>\
**Category:** Elasticsearch\
**Created:** [March 28, 2019, 3:09pm UTC](https://discuss.elastic.co/t/watcher-advise-in-searching-and-filtering/174375 "2019-03-28T15:09:36Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![forestnd](https://avatars.discourse-cdn.com/v4/letter/f/e47774/32.png) [@forestnd](https://discuss.elastic.co/u/forestnd)\
**Post date:** [March 28, 2019, 3:09pm UTC](https://discuss.elastic.co/t/watcher-advise-in-searching-and-filtering/174375/1 "2019-03-28T15:09:36Z")

</div>

Hay all

I am still basic, at watcher and would love some advise,

The below sample i am working on in an trigger to check system load, what works but i want to add an part where it checks for an hostname name, if that makes seance, os like in the last 5 mins for host XXXXX.

```
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "metricbeat-*"
        ],
        "types": [],
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "filter": {
                "range": {
                  "@timestamp": {
                    "gte": "{{ctx.trigger.scheduled_time}}||-5m",
                    "lte": "{{ctx.trigger.scheduled_time}}",
                    "format": "strict_date_optional_time||epoch_millis"
                  }
                }
              }
            }
          },
          "aggs": {
            "bucketAgg": {
              "terms": {
                "field": "beat.hostname",
                "size": 5
              },
              "aggs": {
                "metricAgg": {
                  "avg": {
                    "field": "system.load.1"
                  }
                }
              }
            }
          }
        }
      }
    }
  },

```

Any advice is grate full

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 25, 2019, 3:09pm UTC](https://discuss.elastic.co/t/watcher-advise-in-searching-and-filtering/174375/2 "2019-04-25T15:09:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.