# Watcher Assistance

**URL:** <https://discuss.elastic.co/t/watcher-assistance/218451>\
**Category:** Elasticsearch\
**Created:** [February 8, 2020, 10:38pm UTC](https://discuss.elastic.co/t/watcher-assistance/218451 "2020-02-08T22:38:36Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ted1621](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ted1621/32/63595_2.png) [@ted1621](https://discuss.elastic.co/u/ted1621)\
**Post date:** [February 8, 2020, 10:38pm UTC](https://discuss.elastic.co/t/watcher-assistance/218451/1 "2020-02-08T22:38:36Z")

</div>

Hello I am hoping someone can assist with this JSON watcher alert. I am simply trying to create an alert the triggers when any monitored host experiences 5 failed logon attempts within 1 minute. Thanks in advance for your help

{  
"trigger": {  
"schedule": {  
"interval": "5m"  
}  
},  
"input": {  
"search": {  
"request": {  
"search\_type": "query\_then\_fetch",  
"indices": [  
"winlogbeat-\*"  
],  
"rest\_total\_hits\_as\_int": true,  
"body": {  
"query": {  
"bool": {  
"filter": [  
{  
"range": {  
"@timestamp": {  
"gte": "now-20s",  
"lte": "now"  
}  
}  
}  
],  
"must": {  
"match": {  
"message": "An account failed to log on"  
}  
}  
}  
}  
}  
}  
}  
},  
"condition": {  
"compare": {  
"ctx.payload.hits.total": {  
"gte": 5  
}  
}  
},  
"actions": {  
"email\_1": {  
"email": {  
"profile": "standard",  
"to": [  
"xxxx@xxxxxxx.xxx"  
],  
"subject": "Watch [{{ctx.metadata.name}}] has exceeded the threshold",  
"body": {  
"text": "Failed Logon exceeds threshold"  
}  
}  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 7, 2020, 10:38pm UTC](https://discuss.elastic.co/t/watcher-assistance/218451/2 "2020-03-07T22:38:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.