# Watcher Alert Condition

**URL:** <https://discuss.elastic.co/t/watcher-alert-condition/240972>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-monitoring, elastic-stack-alerting\
**Created:** [July 13, 2020, 12:50pm UTC](https://discuss.elastic.co/t/watcher-alert-condition/240972 "2020-07-13T12:50:06Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![velu](https://avatars.discourse-cdn.com/v4/letter/v/6a8cbe/32.png) [@velu](https://discuss.elastic.co/u/velu)\
**Post date:** [July 13, 2020, 12:50pm UTC](https://discuss.elastic.co/t/watcher-alert-condition/240972/1 "2020-07-13T12:50:06Z")

</div>

Hi ,

Please help me on this how to set conditional alert in watcher ..the alert to be trigger once my threshold breaches more than 10 mins.

Thanks,  
Velu G

---

<div class="post-metadata">

**Author:** ![velu](https://avatars.discourse-cdn.com/v4/letter/v/6a8cbe/32.png) [@velu](https://discuss.elastic.co/u/velu)\
**Post date:** [July 20, 2020, 3:15pm UTC](https://discuss.elastic.co/t/watcher-alert-condition/240972/2 "2020-07-20T15:15:50Z")

</div>

Hi ,

Can someone help me on this

---

<div class="post-metadata">

**Author:** ![pjanzen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pjanzen/32/13756_2.png) [@pjanzen](https://discuss.elastic.co/u/pjanzen)\
**Post date:** [July 20, 2020, 7:47pm UTC](https://discuss.elastic.co/t/watcher-alert-condition/240972/3 "2020-07-20T19:47:13Z")

</div>

What have you tried so far? Whats the data looks like? Whats not working?

You post a question and ask for a solution with providing any information.

---

<div class="post-metadata">

**Author:** ![velu](https://avatars.discourse-cdn.com/v4/letter/v/6a8cbe/32.png) [@velu](https://discuss.elastic.co/u/velu)\
**Post date:** [July 21, 2020, 12:48pm UTC](https://discuss.elastic.co/t/watcher-alert-condition/240972/4 "2020-07-21T12:48:29Z")

</div>

Hi Paul,

Please find the details below...Currently my watcher will trigger the alert whenever the threshold reaches(14) . Instead of this i want to set the conditional alert like the alert need to trigger when my threshold breaches more than or equal to 10 mins.

{  
"trigger": {  
"schedule": {  
"hourly": {  
"minute": [  
0,  
10,  
20,  
30,  
40,  
50  
]  
}  
}  
},  
"input": {  
"search": {  
"request": {  
"search\_type": "query\_then\_fetch",  
"indices": [  
"eastern-mjsqueue-\*"  
],  
"types": ,  
"body": {  
"query": {  
"bool": {  
"must": [  
{  
"match\_all": {}  
},  
{  
"range": {  
"@timestamp": {  
"gte": "now-{{ctx.metadata.range\_date\_time}}"  
}  
}  
},  
{  
"match\_phrase": {  
"fields.eastern\_region": {  
"query": "{{ctx.metadata.region}}"  
}  
}  
},  
{  
"match\_phrase": {  
"jsondoc.mjsdestname.keyword": {  
"query": "easternInboundQueue"  
}  
}  
},  
{  
"range": {  
"jsondoc.messagecurrentCount": {  
"gt": "{{ctx.metadata.threshold}}"  
}  
}  
}  
]  
}  
},  
"aggs": {  
"region": {  
"terms": {  
"field": "fields.eastern\_region.keyword",  
"size": 5,  
"order": {  
"\_term": "desc"  
}  
},  
"aggs": {  
"perc": {  
"percentiles": {  
"field": "jsondoc.messagecurrentCount",  
"percents": [  
90  
],  
"keyed": false  
}  
},  
"currentcount": {  
"max": {  
"field": "jsondoc.messagecurrentCount"  
}  
}  
}  
}  
}  
}  
}  
}  
},  
"condition": {  
"compare": {  
"ctx.payload.hits.total": {  
"gt": 0  
}  
}  
},

"metadata": {  
"watcher\_id": "mjsQ-0001",  
"range\_date\_time": "10m",  
"slack": true,  
"threshold": 14,  
"region": "east-on",  
"watcher\_name": "Alert for eastern mjs Inbound Queue Depth by Percentiles",  
"email": true  
}  
}

Please suggest me how to proceed the conditional alert.

Thanks,  
Velu G

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 18, 2020, 12:48pm UTC](https://discuss.elastic.co/t/watcher-alert-condition/240972/5 "2020-08-18T12:48:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.