# Watcher Assistance (ii)

**URL:** <https://discuss.elastic.co/t/watcher-assistance-ii/265261>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [February 23, 2021, 11:08pm UTC](https://discuss.elastic.co/t/watcher-assistance-ii/265261 "2021-02-23T23:08:22Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![PinkElephant](https://avatars.discourse-cdn.com/v4/letter/p/e5b9ba/32.png) [@PinkElephant](https://discuss.elastic.co/u/PinkElephant)\
**Post date:** [February 23, 2021, 11:08pm UTC](https://discuss.elastic.co/t/watcher-assistance-ii/265261/1 "2021-02-23T23:08:23Z")

</div>

Hey,

Trying to use some code I found in the docs, and am met with an error.

```auto
{
  "trigger": {
    "schedule": {
      "interval": "1m"
    }
  },
  "input": {
    "search": {
      "request": {
        "indices": ".monitoring-*",
        "types": "cluster_state",
        "body": {
          "query": {
            "bool": {
              "filter": [
                {
                  "range": {
                    "timestamp": {
                      "gte": "now-48h"
                    }
                  }
                },
                {
                  "terms": {
                    "cluster_state.status": ["green", "yellow", "red"]
                  }
                }
              ]
            }
          },
          "_source": [
            "cluster_state.status"
          ],
          "sort": [
            {
              "timestamp": {
                "order": "desc"
              }
            }
          ],
          "size": 1,
          "aggs": {
            "minutes": {
              "date_histogram": {
                "field": "timestamp",
                "interval": "5s"
              },
              "aggs": {
                "status": {
                  "terms": {
                    "field": "cluster_state.status",
                    "size": 3
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  "throttle_period": "30m", 
  "condition": {
    "script": {
      "inline": "if (ctx.payload.hits.total < 1) return false; def rows = ctx.payload.hits.hits; if (rows[0]._source.cluster_state.status != 'red') return false; if (ctx.payload.aggregations.minutes.buckets.size() < 12) return false; def last60Seconds = ctx.payload.aggregations.minutes.buckets[-12..-1]; return last60Seconds.every { it.status.buckets.every { s -> s.key == 'red' }}"
    }
  },
  "actions": {
    "send_email": { 
      "email": {
        "to": "redacted", 
        "subject": "Watcher Notification - Cluster has been RED for the last 60 seconds",
        "body": "Your cluster has been red for the last 60 seconds."
      }
    }
  }
}

```

Error:  
`[script_exception] compile error, with { script_stack={ 0="... ions.minutes.buckets[-12..-1]; return last60Second ..." & 1=" ^---- HERE" } & script="if (ctx.payload.hits.total < 1) return false; def rows = ctx.payload.hits.hits; if (rows[0]._source.cluster_state.status != 'red') return false; if (ctx.payload.aggregations.minutes.buckets.size() < 12) return false; def last60Seconds = ctx.payload.aggregations.minutes.buckets[-12..-1]; return last60Seconds.every { it.status.buckets.every { s -> s.key == 'red' }}" & lang="painless" & position={ offset=282 & start=257 & end=307 } }`

How can I resolve this? Was viewing: [Watching Marvel Data | Elasticsearch Watcher [2.4] | Elastic](https://www.elastic.co/guide/en/watcher/current/watching-marvel-data.html#watching-cluster-health)

We're not on this old a version, was simply the only example watch I could find that achieves what we're after.

---

<div class="post-metadata">

**Author:** ![PinkElephant](https://avatars.discourse-cdn.com/v4/letter/p/e5b9ba/32.png) [@PinkElephant](https://discuss.elastic.co/u/PinkElephant)\
**Post date:** [February 28, 2021, 9:25pm UTC](https://discuss.elastic.co/t/watcher-assistance-ii/265261/2 "2021-02-28T21:25:27Z")

</div>

Solved a different way. If anyone has insight into this problem, I'd be ears!

---

<div class="post-metadata">

**Author:** ![PinkElephant](https://avatars.discourse-cdn.com/v4/letter/p/e5b9ba/32.png) [@PinkElephant](https://discuss.elastic.co/u/PinkElephant)\
**Post date:** [March 5, 2021, 5:45am UTC](https://discuss.elastic.co/t/watcher-assistance-ii/265261/3 "2021-03-05T05:45:07Z")

</div>

No longer needed.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 2, 2021, 5:45am UTC](https://discuss.elastic.co/t/watcher-assistance-ii/265261/4 "2021-04-02T05:45:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.