Thanks Alex,
Can't believe I missed that 
do you a have sample watch that works with shield? or do you know where I can find one?
I got this error when I'm trying, if there was an example I can leverage.
{"error":{"root_cause":[{"type":"parse_exception","reason":"could not read search request. unexpected string field [scheme]"}],"type":"parse_exception","reason":"could not parse [search] input for watch [cluster_red_alert]. failed to parse [request]","caused_by":{"type":"parse_exception","reason":"could not read search request. unexpected string field [scheme]"}},"status":400}