# Watcher Filter
**URL:** https://discuss.elastic.co/t/watcher-filter/110695
**Category:** Elasticsearch
**Created:** [December 7, 2017, 2:54pm UTC](https://discuss.elastic.co/t/watcher-filter/110695 "2017-12-07T14:54:02Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Samau4ka](https://discuss.elastic.co/u/Samau4ka)
#### Post date: [December 7, 2017, 2:54pm UTC](https://discuss.elastic.co/t/watcher-filter/110695/1 "2017-12-07T14:54:03Z")
Hi everyone, is there somewhere A filter function for the Watcher Agent in X-pack. I wont him to count all faild logins so he can send me a email if its count over 10 trys in 15min.
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [December 8, 2017, 9:43am UTC](https://discuss.elastic.co/t/watcher-filter/110695/2 "2017-12-08T09:43:05Z")
Hey,
this is exactly what watcher is for, but you need to write the alert by yourself, as we dont know how your data looks like, you need to write your own query. So you need to come up with a query, that searches for failed logins in the last 15 minutes, and check if the count of that query response is greater than 15.
You should check out the [getting started guide](https://www.elastic.co/guide/en/x-pack/6.0/watcher-getting-started.html) and in order to speed up writing your watches, this article might help
> **[Watching the watches: Writing, debugging and testing watches
| Elastic](https://www.elastic.co/blog/watching-the-watches-writing-debugging-and-testing-watches)**
>
> TLDR; This blog post will outline how to efficiently write, execute, and debug watches. This will be useful if you are writing your own watches or if you have to debug watches written by your colleagu...
--Alex
---
### Author:  [@Samau4ka](https://discuss.elastic.co/u/Samau4ka)
#### Post date: [December 8, 2017, 10:16am UTC](https://discuss.elastic.co/t/watcher-filter/110695/3 "2017-12-08T10:16:54Z")
thanks you for the info i will try that. 😁
---
### Author:  [@Samau4ka](https://discuss.elastic.co/u/Samau4ka)
#### Post date: [December 8, 2017, 1:36pm UTC](https://discuss.elastic.co/t/watcher-filter/110695/4 "2017-12-08T13:36:11Z")
it worked for me but ther still a problem my interval is 60s so the watcher will sends me 15 emails over 15 min if he observed real atack is ther an option to send the email only one time
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [December 11, 2017, 8:47am UTC](https://discuss.elastic.co/t/watcher-filter/110695/5 "2017-12-11T08:47:59Z")
you might want to check out throttling in watcher, see
[https://www.elastic.co/guide/en/x-pack/6.0/how-watcher-works.html#watch-acknowledgment-throttling](https://www.elastic.co/guide/en/x-pack/6.0/how-watcher-works.html#watch-acknowledgment-throttling)
---
### Author:  [@Samau4ka](https://discuss.elastic.co/u/Samau4ka)
#### Post date: [December 11, 2017, 1:10pm UTC](https://discuss.elastic.co/t/watcher-filter/110695/6 "2017-12-11T13:10:41Z")
thank you a lot that was the solution 😁 i was searching for "cool down time" wasnt "throttling" on my mind
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 8, 2018, 1:11pm UTC](https://discuss.elastic.co/t/watcher-filter/110695/7 "2018-01-08T13:11:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.