# Watcher Basic Alert
**URL:** https://discuss.elastic.co/t/watcher-basic-alert/52386
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [June 9, 2016, 10:50pm UTC](https://discuss.elastic.co/t/watcher-basic-alert/52386 "2016-06-09T22:50:16Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@dkota](https://discuss.elastic.co/u/dkota)
#### Post date: [June 9, 2016, 10:50pm UTC](https://discuss.elastic.co/t/watcher-basic-alert/52386/1 "2016-06-09T22:50:16Z")
I'm trying to schedule a cluster health alert
curl -k -u usr:pwd-XPUT '[https://localhost:9200/\_watcher/watch/cluster\_red\_alert](https://localhost:9200/_watcher/watch/cluster_red_alert)' -d ' {
"trigger" : {
"schedule" : { "interval" : "10s" }
},
"input" : {
"http" : {
"request" : {
"host" : "localhost",
"port" : 9200,
"path" : "/\_cluster/health"
}
}
}
}'
But this is giving me the error :
"messages" : ["failed to execute watch input"],
"result" : {
"execution\_time" : "2016-06-09T22:41:03.551Z",
"execution\_duration" : 3,
"input" : {
"type" : "http",
"status" : "failure",
"reason" : "SocketException[Unexpected end of file from server]",
"http" : {
"request" : {
"host" : "localhost",
"port" : 9200,
"scheme" : "http",
"method" : "get",
"path" : "/\_cluster/health"
}
}
},
ES 2.3.1
I have shield installed.
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [June 10, 2016, 7:18am UTC](https://discuss.elastic.co/t/watcher-basic-alert/52386/2 "2016-06-10T07:18:25Z")
Hey,
you are trying to execute a HTTP request against a TLS/SSL secured resource, and therefore elasticsearch cuts the connection, as it does not receive the expected TLS data.
- Use HTTPS, by specifying `"scheme" : "https"` in the request. The http input does not know if you are using shield or not, it is basically just a HTTP client and thus not very smart
- If you are using shield it is likely that you are using auth, which requires you to add auth information as well
```json
"request" : {
...
"auth" : {
"basic" : {
"username" : "user",
"password" : "pass"
}
}
```
Hope this helps. Also, please use [code blocks](http://commonmark.org/help/) to show your watch, it makes it incredibly easier for others to read.
--Alex
---
### Author:  [@dkota](https://discuss.elastic.co/u/dkota)
#### Post date: [June 10, 2016, 4:59pm UTC](https://discuss.elastic.co/t/watcher-basic-alert/52386/3 "2016-06-10T16:59:44Z")
Thanks Alex,
Can't believe I missed that 😁
do you a have sample watch that works with shield? or do you know where I can find one?
I got this error when I'm trying, if there was an example I can leverage.
{"error":{"root\_cause":[{"type":"parse\_exception","reason":"could not read search request. unexpected string field [scheme]"}],"type":"parse\_exception","reason":"could not parse [search] input for watch [cluster\_red\_alert]. failed to parse [request]","caused\_by":{"type":"parse\_exception","reason":"could not read search request. unexpected string field [scheme]"}},"status":400}
---
### Author:  [@dkota](https://discuss.elastic.co/u/dkota)
#### Post date: [June 10, 2016, 8:20pm UTC](https://discuss.elastic.co/t/watcher-basic-alert/52386/4 "2016-06-10T20:20:26Z")
If I'm running watcher on the same cluster which I'm watching, would I still need creds?
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [June 13, 2016, 7:14am UTC](https://discuss.elastic.co/t/watcher-basic-alert/52386/5 "2016-06-13T07:14:23Z")
Hey,
see [the almighty doucmentation with an auth example](https://www.elastic.co/guide/en/watcher/current/input.html#_calling_external_webservices) - if you are using the HTTP input, you will have to provide your credentials.
You might also be interested in the [attributes for the request in the search input](https://www.elastic.co/guide/en/watcher/current/input.html#input-http)
Hope this helps.
--Alex
---
### Author:  [@dkota](https://discuss.elastic.co/u/dkota)
#### Post date: [June 13, 2016, 7:37pm UTC](https://discuss.elastic.co/t/watcher-basic-alert/52386/6 "2016-06-13T19:37:04Z")
Thanks Alex,
It did help.
Now I have the alert created. I see this error in the result.condition.reason column in kibana. When I'm monitoring it in Kibana.
ScriptException[failed to run inline script [if (ctx.payload.hits.total \< 1) return false; def rows = ctx.payload.hits.hits; if (rows[0].fields[cluster\_state.status][0] != red) return false; if (ctx.payload.aggregations.minutes.buckets.size() \< 12) return false; def last60Seconds = ctx.payload.aggregations.minutes.buckets[-12..-1]; return last60Seconds.every { it.status.buckets.every { s -\> s.key == red}}] using lang [groovy]]; nested: MissingPropertyException[No such property: cluster\_state for class: a24fecec8b3ef0eeb9944ffefb62dce99822bbab];
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [June 14, 2016, 7:11am UTC](https://discuss.elastic.co/t/watcher-basic-alert/52386/7 "2016-06-14T07:11:36Z")
Hey,
apparently you are trying to access a property that does not exist, which is named `cluster_state`. Why are you using `fields` and not the `_source` field? Also `cluster_state.status` is kind of a shortcut for two elements, and it is not put in quotes, thus interpreted as a variable.
--Alex
---
### Author:  [@dkota](https://discuss.elastic.co/u/dkota)
#### Post date: [June 14, 2016, 3:58pm UTC](https://discuss.elastic.co/t/watcher-basic-alert/52386/8 "2016-06-14T15:58:16Z")
I was using the monitor the marvel data watch from the elasticsearch website.
[https://www.elastic.co/guide/en/watcher/current/watching-marvel-data.html#watching-cluster-health](https://www.elastic.co/guide/en/watcher/current/watching-marvel-data.html#watching-cluster-health)
Only change made was converting into curl command
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [June 15, 2016, 9:56am UTC](https://discuss.elastic.co/t/watcher-basic-alert/52386/9 "2016-06-15T09:56:25Z")
hey,
I just tested the example under [https://www.elastic.co/guide/en/watcher/current/watching-marvel-data.html#watching-cluster-health](https://www.elastic.co/guide/en/watcher/current/watching-marvel-data.html#watching-cluster-health) and replaced red with yellow for testing purposes and it triggered to send an email.
Can you paste the output of
```auto
PUT _watcher/watch/cluster_red_alert/_execute
```
Which Elasticsearch version are you using?
--Alex
---
### Author:  [@dkota](https://discuss.elastic.co/u/dkota)
#### Post date: [June 15, 2016, 10:18am UTC](https://discuss.elastic.co/t/watcher-basic-alert/52386/10 "2016-06-15T10:18:38Z")
thanks Alex. they updated the documentation yesterday...support confirmed
that. also curl was stripping off the quotes from my code. it is working
when I do a json import
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:45pm UTC](https://discuss.elastic.co/t/watcher-basic-alert/52386/11 "2017-07-06T13:45:00Z")