# Watcher Alert on Agent Log Halt

**URL:** <https://discuss.elastic.co/t/watcher-alert-on-agent-log-halt/253633>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting\
**Created:** [October 29, 2020, 2:42am UTC](https://discuss.elastic.co/t/watcher-alert-on-agent-log-halt/253633 "2020-10-29T02:42:23Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![vishakh](https://avatars.discourse-cdn.com/v4/letter/v/c89c15/32.png) [@vishakh](https://discuss.elastic.co/u/vishakh)\
**Post date:** [October 29, 2020, 2:42am UTC](https://discuss.elastic.co/t/watcher-alert-on-agent-log-halt/253633/1 "2020-10-29T02:42:23Z")

</div>

I would request a suggestion on Kibana Watcher script to set alert trigger when a specific server's filebeat agent stops/halts ingesting logs to index.

**Brief** : Trigger alarm when we don't receive logs from a specific filebeat agent (server) for more than 5mins

---

<div class="post-metadata">

**Author:** ![wangqinghuan](https://avatars.discourse-cdn.com/v4/letter/w/d26b3c/32.png) [@wangqinghuan](https://discuss.elastic.co/u/wangqinghuan)\
**Post date:** [October 29, 2020, 3:59am UTC](https://discuss.elastic.co/t/watcher-alert-on-agent-log-halt/253633/2 "2020-10-29T03:59:52Z")

</div>

Do you have any troubles in using Watcher. Kibana also provide a Web UI to configure Watcher.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/a/ea3ea83e71d93feca995f9c8ec11ce9fa4a764d3.png)

---

<div class="post-metadata">

**Author:** ![vishakh](https://avatars.discourse-cdn.com/v4/letter/v/c89c15/32.png) [@vishakh](https://discuss.elastic.co/u/vishakh)\
**Post date:** [October 29, 2020, 4:18am UTC](https://discuss.elastic.co/t/watcher-alert-on-agent-log-halt/253633/3 "2020-10-29T04:18:18Z")

</div>

@wangqinghuan From the UI, i couldn't see an option to select-define the agent-hostname onto which I can configure alarm for

Example: I've a server "nginx-master" having a filebeat installed on it. So, I would need to create alarm specifically for this server/agent so that I can receive alerts if this servers doesn't ingest (or) if ELK doesn't receive any logs from this server for a period of \>5mins

---

<div class="post-metadata">

**Author:** ![wangqinghuan](https://avatars.discourse-cdn.com/v4/letter/w/d26b3c/32.png) [@wangqinghuan](https://discuss.elastic.co/u/wangqinghuan)\
**Post date:** [October 29, 2020, 4:38am UTC](https://discuss.elastic.co/t/watcher-alert-on-agent-log-halt/253633/4 "2020-10-29T04:38:32Z")

</div>

okay, try this script:

```
{
  "trigger": {
    "schedule": {
      "interval": "1m"
    }
  },
  "input": {
    "search": {
      "request": {
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "must": [
                {
                  "term": {
                    "host.keyword": "nginx-host"
                  }
                },
                {
                  "range": {
                    "@timestamp": {
                      "gte": "{{ctx.trigger.scheduled_time}}||-5m",
                      "lte": "{{ctx.trigger.scheduled_time}}",
                      "format": "strict_date_optional_time||epoch_millis"
                    }
                  }
                }
              ]
            }
          }
        },
        "indices": [
          "filebeats*"
        ]
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "eq": 0
      }
    }
  },
  "actions": {
    "my-logging-action": {
      "logging": {
        "text": "There are no document in your index for last 5 minutes."
      }
    }
  }
}
```

---

<div class="post-metadata">

**Author:** ![vishakh](https://avatars.discourse-cdn.com/v4/letter/v/c89c15/32.png) [@vishakh](https://discuss.elastic.co/u/vishakh)\
**Post date:** [October 29, 2020, 3:16pm UTC](https://discuss.elastic.co/t/watcher-alert-on-agent-log-halt/253633/5 "2020-10-29T15:16:39Z")

</div>

Thank You @wangqinghuan

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 26, 2020, 3:16pm UTC](https://discuss.elastic.co/t/watcher-alert-on-agent-log-halt/253633/6 "2020-11-26T15:16:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.