# Watcher alerting for winlogbeat
**URL:** https://discuss.elastic.co/t/watcher-alerting-for-winlogbeat/122096
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [March 1, 2018, 2:33pm UTC](https://discuss.elastic.co/t/watcher-alerting-for-winlogbeat/122096 "2018-03-01T14:33:18Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)
#### Post date: [March 1, 2018, 2:33pm UTC](https://discuss.elastic.co/t/watcher-alerting-for-winlogbeat/122096/1 "2018-03-01T14:33:18Z")
Hi,
I need to have watcher enabled or machine learning enabled for this specific function.
I have a saved search in kibana named as – Windows Event ID - 4740 - Account Lockout
It is a filter for only the event id 4740 from winlogbeat.
I would like to know or get notified when a unique count of event\_data.TargetUserName has more than 4 entries in 24 hours
The notification I would like to have notification from either watcher or machine learning with these fields if that particular criteria was met
event\_data.SubjectDomainName
event\_data.SubjectUserName
event\_data.TargetDomainName
event\_data.TargetUserName
event\_id
@timestamp
Please do let me know how to create a watcher for this
Thanks,
Raj
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [March 1, 2018, 11:15pm UTC](https://discuss.elastic.co/t/watcher-alerting-for-winlogbeat/122096/2 "2018-03-01T23:15:20Z")
Hey,
basically this question boils down to the fact if you are able to write a query that is able to return your required data.
You need to execute a search that filters by timestamp and is doing a terms aggregation with a min doc count of 4 on the target user name field.
If you get back any aggregation results, than you need to execute a search transform to retrieve all the data of the usernames that were returned in the bucket, which then can be used in an action (like sending an email or sending a slack notification).
You might want to check the [examples repo](https://github.com/elastic/examples/tree/master/Alerting) for watcher and this [blog post](https://www.elastic.co/blog/watching-the-watches-writing-debugging-and-testing-watches) to learn how to write and debug watches with short iteration circles.
--Alex
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 29, 2018, 11:15pm UTC](https://discuss.elastic.co/t/watcher-alerting-for-winlogbeat/122096/3 "2018-03-29T23:15:24Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.