# \[Watcher\] - Alerting on metricbeat monitored processes

**URL:** <https://discuss.elastic.co/t/watcher-alerting-on-metricbeat-monitored-processes/252660>\
**Category:** Elasticsearch\
**Created:** [October 20, 2020, 10:11am UTC](https://discuss.elastic.co/t/watcher-alerting-on-metricbeat-monitored-processes/252660 "2020-10-20T10:11:43Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![bevano](https://avatars.discourse-cdn.com/v4/letter/b/6bbea6/32.png) [@bevano](https://discuss.elastic.co/u/bevano)\
**Post date:** [October 20, 2020, 10:11am UTC](https://discuss.elastic.co/t/watcher-alerting-on-metricbeat-monitored-processes/252660/1 "2020-10-20T10:11:43Z")

</div>

Hi All,

I need some advice on how to implement watcher alerting. For example, we have 10 application servers, that have 5 programs running as processes. I have already installed metricbeat on these servers, and can see documents within the metricbeat index saying that

```
process.name: chrome.exe
system.process.state: running

```

Metricbeat is set to check every 30 seconds, and thus sends 1 document every 30 seconds, also equating to 10 every 5 minutes

I want to implement alerts for when one of these process has crashed or is not running. This is where it gets a bit difficult. From my implementation, metricbeat only monitors if the process is running, you don't get a message saying that the process is suspended, crashed or whatever else (unless someone has a magic solution?)

So the only way I can think of implementing alerting, is to create a watcher that counts the number of documents, with a conditional alert that triggers if it less than 5 document are counted within a 5 minute period (allow for missed messaged?)

This seems awfully complicated for something thats quite a basic function of a monitoring tool. By my calculations I need to implement 50 watchers (10 servers 5 processes).

Is this the only way to do it? Or does someone have any other ideas?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 17, 2020, 10:12am UTC](https://discuss.elastic.co/t/watcher-alerting-on-metricbeat-monitored-processes/252660/2 "2020-11-17T10:12:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.