# Watcher API - ACK with Action Conditions

**URL:** <https://discuss.elastic.co/t/watcher-api-ack-with-action-conditions/341277>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting, painless\
**Created:** [August 21, 2023, 3:59pm UTC](https://discuss.elastic.co/t/watcher-api-ack-with-action-conditions/341277 "2023-08-21T15:59:54Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Charles614](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/charles614/32/65851_2.png) [@Charles614](https://discuss.elastic.co/u/Charles614)\
**Post date:** [August 21, 2023, 3:59pm UTC](https://discuss.elastic.co/t/watcher-api-ack-with-action-conditions/341277/1 "2023-08-21T15:59:54Z")

</div>

Hello all,

I have been building a Watcher that has a transform and then any number of actions dependent upon user input. I want to make it to where a user can ACK a specific action in order to allow throttling.

The way I have configured the watcher is there is a generalized **condition** that just checks the initial payload from the **input** , then that payload is sent through the **transform** and each action has a **condition** attached that checks this transformed payload to see if the action can execute or not.

**THE QUESTION**  
If a user has ACK'd a specific action, would the state of the Watcher go back to **await\_successful\_execution** when the overall **condition** is met or only if that specific **action's condition** is met?

I have attempted testing this and it would seem that even if I were to ACK a specific action, if the overall condition is met, the state of the watcher is set back to **awaits\_successful\_execution** when it would be better if it would stay in the **acked** state until the specific **action's condition** is met. It could be I am just doing something wrong but after reading through [documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/watcher-api-ack-watch.html), I am a bit confused.

Here is my Watcher with some information scraped out/replaced:

```auto
{
  "trigger": {
    "schedule": {
      "interval": "5m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "myIndex"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 10000,
          "_source": {
            "includes": [
              "displayname",
              "location_name",
              "hostname",
              "status"
            ]
          },
          "query": {
            "bool": {
              "must": [
                {
                  "match": {
                    "enabled": 1
                  }
                },
                {
                  "match": {
                    "status": 0
                  }
                }
              ],
              "filter": [
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-5m",
                      "lte": "now"
                    }
                  }
                }
              ]
            }
          }
        }
      }
    }
  },
  "condition": {
    "script": {
      "source": "ctx['payload']['hits']['hits'].size() > 0",
      "lang": "painless"
    }
  },
  "transform": {
    "script": {
      "id": "myTransformScript"
    }
  },
  "metadata": {
    "comment": "metadata has a lot of parameters that are used throughout this watcher, but they are business sensitive, so these are omitted as they do not pertain to the question."
  },
  "actions": {
    "email": {
      "condition": {
        "script": {
          "source": "ctx['payload']['total'] > 0",
          "lang": "painless"
        }
      },
      "email": {
        "profile": "standard",
        "attachments": {
          "data.json": {
            "data": {
              "format": "json"
            }
          }
        },
        "to": [
          "someEmail@gmail.com"
        ],
        "subject": "You got a problem!",
        "body": {
          "html": {
            "id": "mustacheTemplateForEmail"
          }
        }
      }
    }
  }
}

```

Here is the way I am ACKing the **email** :  
POST \_watcher/watch/myWatcher/\_ack/email

If further clarification is needed, I can provide that. Thank you ahead of time for any help given!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 18, 2023, 4:00pm UTC](https://discuss.elastic.co/t/watcher-api-ack-with-action-conditions/341277/2 "2023-09-18T16:00:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.