# Watcher alert syntax error
**URL:** https://discuss.elastic.co/t/watcher-alert-syntax-error/269920
**Category:** Kibana
**Tags:** elastic-stack-alerting
**Created:** [April 12, 2021, 5:13pm UTC](https://discuss.elastic.co/t/watcher-alert-syntax-error/269920 "2021-04-12T17:13:55Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)
#### Post date: [April 12, 2021, 5:13pm UTC](https://discuss.elastic.co/t/watcher-alert-syntax-error/269920/1 "2021-04-12T17:13:55Z")
Hello,
I have the following watcher alert code.
I simply want to check if 2 specific messages (at least 1 out of 2) exist in the message field of a certain facility named: galaxus-service.
BUT i get the syntax error of image 1 while trying.
```
{
"trigger": {
"schedule": {
"interval": "2m"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"sag-gelf-logs-*"
],
"rest_total_hits_as_int": true,
"body": {
"size": 0,
"query":
{
"bool": {
"must":
[
{
"match": {
"facility": "galaxus-service"
}
}
],
"filter":
[
{
"range": {
"@timestamp": {
"gte": "now-100d"
}
}
}
],
"should": [
"bool":
{
"should": [
{
"match_phrase": {
"message": "*an HttpOperationFailedException exception was raised:*"
}
},
{
"match_phrase": {
"message": "*rejectOrderException was raised:
com.sagag.fuse.edi4customers.exception.RejectOrderException"
}
}
],
"minimum_should_match": 1
}
]
}
}
}
}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gt": 0
}
}
}
}
```
Why i get that syntax error ?
Thank you!
---
### Author:  [@AClerk](https://discuss.elastic.co/u/AClerk)
#### Post date: [April 13, 2021, 5:12am UTC](https://discuss.elastic.co/t/watcher-alert-syntax-error/269920/2 "2021-04-13T05:12:11Z")
> [@Alexandros888](#):
>
> ```auto
> ...
> ],
> "should": [
> "bool":
> ...
>
> ```
--\>
```auto
"should": [
"bool",
```
I dont know if your script is correct, but you have a JSON syntax issue.
---
### Author:  [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)
#### Post date: [April 13, 2021, 6:14am UTC](https://discuss.elastic.co/t/watcher-alert-syntax-error/269920/3 "2021-04-13T06:14:03Z")
> [@Alexandros888](#):
>
> ```auto
> {
> "trigger": {
> "schedule": {
> "interval": "2m"
> }
> },
> "input": {
> "search": {
> "request": {
> "search_type": "query_then_fetch",
> "indices": [
> "sag-gelf-logs-*"
> ],
> "rest_total_hits_as_int": true,
> "body": {
> "size": 0,
> "query":
> {
> "bool": {
> "must":
> [
> {
> "match": {
> "facility": "galaxus-service"
> }
> }
> ],
> "filter":
> [
> {
> "range": {
> "@timestamp": {
> "gte": "now-100d"
> }
> }
> }
> ],
> "should": [
> "bool":
> {
> "should": [
> {
> "match_phrase": {
> "message": "*an HttpOperationFailedException exception was raised:*"
> }
> },
> {
> "match_phrase": {
> "message": "*rejectOrderException was raised:
> com.sagag.fuse.edi4customers.exception.RejectOrderException"
> }
> }
>
> ],
> "minimum_should_match": 1
> }
> ]
>
> }
> }
> }
> }
> }
> },
> "condition": {
> "compare": {
> "ctx.payload.hits.total": {
> "gt": 0
> }
> }
> }
> }
>
> ```
Hello AClerk. Thank you. But i still dont unerstand why it is wrong. I just have a a should statement within another should statement and in order to implement (a should within should) i have a bool statement between them.
```
"should": [
"bool":
{
"should": [
{
"match_phrase": {
"message": "*an HttpOperationFailedException exception was raised:*"
}
},
{
"match_phrase": {
"message": "*rejectOrderException was raised:
com.sagag.fuse.edi4customers.exception.RejectOrderException"
}
}
],
"minimum_should_match": 1
}
]
```
Thank you
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 11, 2021, 6:14am UTC](https://discuss.elastic.co/t/watcher-alert-syntax-error/269920/4 "2021-05-11T06:14:44Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.