# Watcher compare condition not generating any hits **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-alerting\ **Created:** [June 9, 2015, 8:14am UTC](https://discuss.elastic.co/t/watcher-compare-condition-not-generating-any-hits/2192 "2015-06-09T08:14:13Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Ajit\_Bhingarkar](https://avatars.discourse-cdn.com/v4/letter/a/13edae/32.png) [@Ajit\_Bhingarkar](https://discuss.elastic.co/u/Ajit_Bhingarkar)\ **Post date:** [June 9, 2015, 8:14am UTC](https://discuss.elastic.co/t/watcher-compare-condition-not-generating-any-hits/2192/1 "2015-06-09T08:14:14Z")
Hi, I have configured 4 wathes; and see that they get triggered fine. However compare condition is not met and no action is taken. Can you pls advice if anything is wrong with these conditions? I am attaching couple of snippets returned by get watcher history API. Will really appreciate any help or pointers.I have tried to mark relevant sections in bold. Thanks, Ajit 1. ``` "input": {"search": {"request": { "search_type": "query_then_fetch", "indices": ["logstash-index"], "types": [], **"body": {"query": {"match": {"Battery Voltage Normal": "Low"}}}** }}}, **"condition": {"compare": {"ctx.payload.hits.total": {"gt": 0}}},** "state": "execution_not_needed", "execution_result": { "execution_time": "2015-06-08T18:45:27.351Z", "input": {"search": { **"payload": {** **"hits": {** **"total": 0,** "hits": [], "max_score": null }, ``` 1. ``` "input": {"search": {"request": { "search_type": "query_then_fetch", "indices": ["logstash-index"], "types": [], **"body": {"query": {"filtered": {"filter": {"range": {"Temprature (C)": {"gte": 35}}}}}}** }}}, **"condition": {"compare": {"ctx.payload.hits.total": {"gt": 0}}},** "state": "execution_not_needed", "execution_result": { "execution_time": "2015-06-08T18:44:37.283Z", "input": {"search": { **"payload": {** **"hits": {** **"total": 0,** **"hits": [],** "max_score": null }, ``` ---
**Author:** ![uboness](https://avatars.discourse-cdn.com/v4/letter/u/96bed5/32.png) [@uboness](https://discuss.elastic.co/u/uboness)\ **Post date:** [June 9, 2015, 8:21am UTC](https://discuss.elastic.co/t/watcher-compare-condition-not-generating-any-hits/2192/2 "2015-06-09T08:21:20Z")
If you do a search outside of watcher, do you get any results for this? ``` GET logstash-index/_search { "query": { "match": { "Battery Voltage Normal": "Low" } } } ``` ps, is "Battery Voltage Normal" really the field name? ---
**Author:** ![Ajit\_Bhingarkar](https://avatars.discourse-cdn.com/v4/letter/a/13edae/32.png) [@Ajit\_Bhingarkar](https://discuss.elastic.co/u/Ajit_Bhingarkar)\ **Post date:** [June 9, 2015, 8:35am UTC](https://discuss.elastic.co/t/watcher-compare-condition-not-generating-any-hits/2192/3 "2015-06-09T08:35:17Z")
Thanks Uri. Yes "Battery Voltage Normal" is the real field. I tried GET /logstash-index/\_search,and I did get following. It seems indexes have not been built for all of watches. How do I proceed now? Many thanks. { "took": 2, "timed\_out": false, "\_shards": { "total": 5, "successful": 5, "failed": 0 }, "hits": { "total": 0, "max\_score": null, "hits": [] } } ---
**Author:** ![uboness](https://avatars.discourse-cdn.com/v4/letter/u/96bed5/32.png) [@uboness](https://discuss.elastic.co/u/uboness)\ **Post date:** [June 9, 2015, 8:40am UTC](https://discuss.elastic.co/t/watcher-compare-condition-not-generating-any-hits/2192/4 "2015-06-09T08:40:08Z")
so it seems to work fine, no? - The actions will only execute if the condition is met. - The condition will be met only if there are any search results (`{"compare": {"ctx.payload.hits.total": {"gt": 0}}}`). - since no search results are returned, the condition is not met and therefore the actions are not executing ---
**Author:** ![Ajit\_Bhingarkar](https://avatars.discourse-cdn.com/v4/letter/a/13edae/32.png) [@Ajit\_Bhingarkar](https://discuss.elastic.co/u/Ajit_Bhingarkar)\ **Post date:** [June 9, 2015, 8:41am UTC](https://discuss.elastic.co/t/watcher-compare-condition-not-generating-any-hits/2192/5 "2015-06-09T08:41:36Z")
I got that now, but do I rebuild the indexes so that \_search would return correct results? Thanks, ---
**Author:** ![Ajit\_Bhingarkar](https://avatars.discourse-cdn.com/v4/letter/a/13edae/32.png) [@Ajit\_Bhingarkar](https://discuss.elastic.co/u/Ajit_Bhingarkar)\ **Post date:** [June 9, 2015, 8:43am UTC](https://discuss.elastic.co/t/watcher-compare-condition-not-generating-any-hits/2192/6 "2015-06-09T08:43:19Z")
Also on cmd prompt I keep getting these messages, indicating watcher history is getting updated ok. [2015-06-09 14:11:42,495][DEBUG][watcher.history] [Boomer] successfull y updated watch record [battery\_voltage\_low\_error\_watch\_58-2015-06-09T08:41:42.4 80Z] [2015-06-09 14:11:42,496][DEBUG][watcher.input.simple] [Boomer] [DG\_on\_off\_ watch\_58-2015-06-09T08:41:42.480Z] found [DG\_on\_off\_watch] hits [2015-06-09 14:11:42,498][DEBUG][watcher.history] [Boomer] successfull y updated watch record [DG\_on\_off\_watch\_58-2015-06-09T08:41:42.480Z] [2015-06-09 14:11:42,499][DEBUG][watcher.history] [Boomer] successfull y updated watch record [pilfered\_fuel\_watch\_58-2015-06-09T08:41:42.480Z] [2015-06-09 14:11:42,499][DEBUG][watcher.history] [Boomer] successfull y updated watch record [temp\_high\_error\_watch\_58-2015-06-09T08:41:42.480Z] ---
**Author:** ![uboness](https://avatars.discourse-cdn.com/v4/letter/u/96bed5/32.png) [@uboness](https://discuss.elastic.co/u/uboness)\ **Post date:** [June 9, 2015, 8:48am UTC](https://discuss.elastic.co/t/watcher-compare-condition-not-generating-any-hits/2192/7 "2015-06-09T08:48:15Z")
not sure what you mean by "rebuild the indexes", but watcher doesn't really care what indexes you're search, it just executes the search you configure. If you index documents into the `logstash-index` and one of the documents will have a `Battery Voltage Normal` field with a `Low` value. Then the condition will be met and the actions will execute. So in your case, it's all about populating the `logstash-index` with data. ---
**Author:** ![Ajit\_Bhingarkar](https://avatars.discourse-cdn.com/v4/letter/a/13edae/32.png) [@Ajit\_Bhingarkar](https://discuss.elastic.co/u/Ajit_Bhingarkar)\ **Post date:** [June 9, 2015, 8:50am UTC](https://discuss.elastic.co/t/watcher-compare-condition-not-generating-any-hits/2192/8 "2015-06-09T08:50:43Z")
Yes. Thanks. I am restarting everything. I had followed the procedure; created index; created watches, and uploaded data. Still logstash-index does not seem to have documents. I was wondering what could have gone wrong? ---
**Author:** ![uboness](https://avatars.discourse-cdn.com/v4/letter/u/96bed5/32.png) [@uboness](https://discuss.elastic.co/u/uboness)\ **Post date:** [June 9, 2015, 8:55am UTC](https://discuss.elastic.co/t/watcher-compare-condition-not-generating-any-hits/2192/9 "2015-06-09T08:55:54Z")
I'd focus on the "uploaded data" part before looking into watcher, your problem is somewhere there as even a simple search request doesn't return results. Once you index the data successfully and you see that a simple search request work, then your watch should work as well. ---
**Author:** ![Ajit\_Bhingarkar](https://avatars.discourse-cdn.com/v4/letter/a/13edae/32.png) [@Ajit\_Bhingarkar](https://discuss.elastic.co/u/Ajit_Bhingarkar)\ **Post date:** [June 9, 2015, 8:59am UTC](https://discuss.elastic.co/t/watcher-compare-condition-not-generating-any-hits/2192/10 "2015-06-09T08:59:00Z")
I have dashboards built off that data, so all other indexes built in Kabana (one mapped to @timestamp), seem to be working fine. I see an index for each day created for my records worth 6 months. Let me do everything afresh and get back. Thanks again. ---
**Author:** ![Ajit\_Bhingarkar](https://avatars.discourse-cdn.com/v4/letter/a/13edae/32.png) [@Ajit\_Bhingarkar](https://discuss.elastic.co/u/Ajit_Bhingarkar)\ **Post date:** [June 9, 2015, 9:00am UTC](https://discuss.elastic.co/t/watcher-compare-condition-not-generating-any-hits/2192/11 "2015-06-09T09:00:42Z")
One quick thing; should I use logstash-index created for watches also as part of logstash configuration while uploading data? ---
**Author:** ![uboness](https://avatars.discourse-cdn.com/v4/letter/u/96bed5/32.png) [@uboness](https://discuss.elastic.co/u/uboness)\ **Post date:** [June 9, 2015, 9:02am UTC](https://discuss.elastic.co/t/watcher-compare-condition-not-generating-any-hits/2192/12 "2015-06-09T09:02:02Z")
> [@Ajit\_Bhingarkar](#): > > logstash-index created for watches did you create `logstash-index` specially for watcher? ---
**Author:** ![Ajit\_Bhingarkar](https://avatars.discourse-cdn.com/v4/letter/a/13edae/32.png) [@Ajit\_Bhingarkar](https://discuss.elastic.co/u/Ajit_Bhingarkar)\ **Post date:** [June 9, 2015, 9:02am UTC](https://discuss.elastic.co/t/watcher-compare-condition-not-generating-any-hits/2192/13 "2015-06-09T09:02:29Z")
Yes, just for watches. ---
**Author:** ![uboness](https://avatars.discourse-cdn.com/v4/letter/u/96bed5/32.png) [@uboness](https://discuss.elastic.co/u/uboness)\ **Post date:** [June 9, 2015, 9:03am UTC](https://discuss.elastic.co/t/watcher-compare-condition-not-generating-any-hits/2192/14 "2015-06-09T09:03:41Z")
so two questions: 1. are you populating it with data somehow? 2. why don't you simply search directly on the logstash indices (`logstash-*`)? ---
**Author:** ![Ajit\_Bhingarkar](https://avatars.discourse-cdn.com/v4/letter/a/13edae/32.png) [@Ajit\_Bhingarkar](https://discuss.elastic.co/u/Ajit_Bhingarkar)\ **Post date:** [June 9, 2015, 9:05am UTC](https://discuss.elastic.co/t/watcher-compare-condition-not-generating-any-hits/2192/15 "2015-06-09T09:05:45Z")
1. No 2. In that cases do I need to recreate by watches to use one of the indexes I create in Kibana? logstash-\* is one of them as well.This can happen only after data is uploaded though. Thanks. ---
**Author:** ![uboness](https://avatars.discourse-cdn.com/v4/letter/u/96bed5/32.png) [@uboness](https://discuss.elastic.co/u/uboness)\ **Post date:** [June 9, 2015, 9:08am UTC](https://discuss.elastic.co/t/watcher-compare-condition-not-generating-any-hits/2192/16 "2015-06-09T09:08:52Z")
> [@Ajit\_Bhingarkar](#): > > do I need to recreate by watches to use one of the indexes I create in Kibana? logstash-\* is one of them as well.This can happen only after data is uploaded though. You can simply update your watch (change the index name to `logstash-*` and re-PUT the watch)... it doesn't need to wait for the data to be there... if there is no `logstash-*` then the search will return an error and the error will be stored as part of the watch record... once the index is there, the watch will executed as expected ---
**Author:** ![Ajit\_Bhingarkar](https://avatars.discourse-cdn.com/v4/letter/a/13edae/32.png) [@Ajit\_Bhingarkar](https://discuss.elastic.co/u/Ajit_Bhingarkar)\ **Post date:** [June 9, 2015, 9:10am UTC](https://discuss.elastic.co/t/watcher-compare-condition-not-generating-any-hits/2192/17 "2015-06-09T09:10:14Z")
Will do. I have now cleaned up everything so it is little late, but I got the mistake I was doing. Thank you very much. ---
**Author:** ![uboness](https://avatars.discourse-cdn.com/v4/letter/u/96bed5/32.png) [@uboness](https://discuss.elastic.co/u/uboness)\ **Post date:** [June 9, 2015, 9:12am UTC](https://discuss.elastic.co/t/watcher-compare-condition-not-generating-any-hits/2192/18 "2015-06-09T09:12:08Z")
no worries... good luck ---
**Author:** ![Ajit\_Bhingarkar](https://avatars.discourse-cdn.com/v4/letter/a/13edae/32.png) [@Ajit\_Bhingarkar](https://discuss.elastic.co/u/Ajit_Bhingarkar)\ **Post date:** [June 9, 2015, 9:34am UTC](https://discuss.elastic.co/t/watcher-compare-condition-not-generating-any-hits/2192/19 "2015-06-09T09:34:55Z")
Just FYI... logstash-\* is not accepted as an index name through PUT index API. { "error": "InvalidIndexNameException[[logstash-_] Invalid index name [logstash-_], must not contain the following characters [\, /, \*, ?, ", \<, \>, |, , ,]]", "status": 400 } ---
**Author:** ![uboness](https://avatars.discourse-cdn.com/v4/letter/u/96bed5/32.png) [@uboness](https://discuss.elastic.co/u/uboness)\ **Post date:** [June 9, 2015, 10:12am UTC](https://discuss.elastic.co/t/watcher-compare-condition-not-generating-any-hits/2192/20 "2015-06-09T10:12:38Z")
yea.. you can't index to `logstash-*`, only search it. But if you're using logstash you don't need to worry about it as logstash takes care of creating (by default) daily indices in the form of `logstash-2015.06.07`, `logstash-2015.06.08`, `logstash-2015.06.09`, etc... Searching on `logstash-*` will search all these indices [Next page](https://discuss.elastic.co/t/watcher-compare-condition-not-generating-any-hits/2192.md?page=2)