# Watcher Field Value Based Alerts

**URL:** <https://discuss.elastic.co/t/watcher-field-value-based-alerts/283871>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [September 10, 2021, 12:29pm UTC](https://discuss.elastic.co/t/watcher-field-value-based-alerts/283871 "2021-09-10T12:29:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Zunera\_Nayyar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zunera_nayyar/32/85862_2.png) [@Zunera\_Nayyar](https://discuss.elastic.co/u/Zunera_Nayyar)\
**Post date:** [September 10, 2021, 12:29pm UTC](https://discuss.elastic.co/t/watcher-field-value-based-alerts/283871/1 "2021-09-10T12:29:16Z")

</div>

Hi,

I have an app which returns different statuscodes based on URL being hit. I want to generate make a watcher alert based on the values in the same field with different outputs. I do not want the collective count/aggregated alerts. For example:

> statuscode field can have values 220, 221, 222  
> the single alert should check each statuscode count separately  
> apply the threshold separately for each aggregated value  
> generate unique alert for each.

Currently I am using this which gives the collective count of each value. I want to separate the searched ctx.payloads.hits.total for each of the value

```auto
{
  "trigger": {
    "schedule": {
      "interval": "30h"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "custom*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "query": {
            "bool": {
              "must": [
                {
                  "query_string": {
                    "query": "220 OR 221 OR 222"
                  }
                },
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-10m"
                    }
                  }
                }
              ]
            }
          },
          "_source": [
            "StatusCode"
          ],
          "sort": [
            {
              "@timestamp": {
                "order": "desc"
              }
            }
          ]
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gte": 5
      }
    }
  },
  "actions": {
    "notify-slack": {
      "throttle_period_in_millis": 60000,
      "slack": {
        "message": {
          "from": "watcher1",
          "to": [
            "#elastalert"
          ],
          "text": "There are {{ctx.payload.hits.total}} error messages for node-app. Threshold is 5"
        }
      }
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [September 13, 2021, 2:09pm UTC](https://discuss.elastic.co/t/watcher-field-value-based-alerts/283871/2 "2021-09-13T14:09:54Z")

</div>

There are a couple of possibilities.

First, have a dedicated watcher for every status code. If you are using throttling/acknowleding alerts, then this probably makes most sense.

Second, keep using aggregations and have dedicated action for each statuscode, by using a condition as part of the action filtering for the status code.

Hope that helps as a start!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 11, 2021, 2:10pm UTC](https://discuss.elastic.co/t/watcher-field-value-based-alerts/283871/3 "2021-10-11T14:10:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.