# Watcher creation help

**URL:** https://discuss.elastic.co/t/watcher-creation-help/315309
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [September 27, 2022, 8:20pm UTC](https://discuss.elastic.co/t/watcher-creation-help/315309 "2022-09-27T20:20:08Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![ffmdsuperit](https://avatars.discourse-cdn.com/v4/letter/f/bb73d2/32.png) [@ffmdsuperit](https://discuss.elastic.co/u/ffmdsuperit)
#### Post date: [September 27, 2022, 8:20pm UTC](https://discuss.elastic.co/t/watcher-creation-help/315309/1 "2022-09-27T20:20:09Z")

</div>

Hello! I'm very new to Elasticsearch and I am attempting to create a Watcher, but I just can't seem to put the pieces together.

I have a index named "transactions". For that index I run this query "TerminalID : 999999 and day\_of\_week : Fri and OurTime: 11\*" and last Friday it returned 7 results when I run it at 12:00PM.

I'd like to have the Watcher look at "1 week ago" till "Today", it should run at 12:00PM, and if the matching results are less than X then trigger an email alert.

Just testing a basic search I have the below "code", but I'm not sure how to limit the search to "1 Week Ago until Today". And I'm not sure this format could translate to a Watcher.

```auto
GET /transactions/_search
{
    "query": {
      "query_string": {
        "query": "TerminalID : 999999 and day_of_week : Fri and OurTime: 11*"
      }
    },
    "fields": [
      "TerminalID",
      "day_of_week",
      "OurTime"
    ]
}

```

I'd really appreciate some assistance with this. Thank you.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 25, 2022, 8:20pm UTC](https://discuss.elastic.co/t/watcher-creation-help/315309/2 "2022-10-25T20:20:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
