# Watcher Cluster Health

**URL:** <https://discuss.elastic.co/t/watcher-cluster-health/27867>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [August 22, 2015, 1:06am UTC](https://discuss.elastic.co/t/watcher-cluster-health/27867 "2015-08-22T01:06:52Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mmack000](https://avatars.discourse-cdn.com/v4/letter/m/6f9a4e/32.png) [@mmack000](https://discuss.elastic.co/u/mmack000)\
**Post date:** [August 22, 2015, 1:06am UTC](https://discuss.elastic.co/t/watcher-cluster-health/27867/1 "2015-08-22T01:06:52Z")

</div>

I'm using the example cluster health watch to monitor if cluster goes into yellow state. I'm following watch is failing to execute. Any help would be appreciated. Other watches are working correctly.

PUT \_watcher/watch/cluster\_yellow\_alert  
{  
"trigger": {  
"schedule": {  
"interval": "1m"  
}  
},  
"input": {  
"search": {  
"request": {  
"indices": ".marvel-\*",  
"types": "cluster\_stats",  
"body": {  
"query": {  
"filtered": {  
"filter": {  
"bool": {  
"must": [  
{  
"range": {  
"@timestamp": {  
"gte": "now-2m",  
"lte": "now"  
}  
}  
}  
],  
"should": [  
{  
"term": {  
"status.raw": "red"  
}  
},  
{  
"term": {  
"status.raw": "green"  
}  
},  
{  
"term": {  
"status.raw": "yellow"  
}  
}  
]  
}  
}  
}  
},  
"fields": ["@timestamp","status"],  
"sort": [  
{  
"@timestamp": {  
"order": "desc"  
}  
}  
],  
"size": 1,  
"aggs": {  
"minutes": {  
"date\_histogram": {  
"field": "@timestamp",  
"interval": "5s"  
},  
"aggs": {  
"status": {  
"terms": {  
"field": "status.raw",  
"size": 3  
}  
}  
}  
}  
}  
}  
}  
}  
},  
"throttle\_period": "5m",  
"condition": {  
"script": {  
"inline": "if (ctx.payload.hits.total \< 1) return false; def rows = ctx.payload.hits.hits; if (rows[0].fields.status[0] != 'yellow') return false; if (ctx.payload.aggregations.minutes.buckets.size() \< 12) return false; def last60Seconds = ctx.payload.aggregations.minutes.buckets[-12..-1]; return last60Seconds.every { it.status.buckets.every { s -\> s.key == 'yellow' } }"  
}  
},  
"actions": {  
"send\_email": {  
"email": {  
"to": "removed email address",  
"subject": "[PRE] Watcher Notification - Cluster has been yellow for the last 60 seconds",  
"body": "Your cluster has been yellow for the last 60 seconds."  
}  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [August 22, 2015, 7:56am UTC](https://discuss.elastic.co/t/watcher-cluster-health/27867/2 "2015-08-22T07:56:14Z")

</div>

What do you mean by failing to execute? Are you getting errors in the logs, something else?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:48pm UTC](https://discuss.elastic.co/t/watcher-cluster-health/27867/3 "2017-07-06T13:48:54Z")

</div>