# Watcher for nodes in elasticsearch **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-alerting\ **Created:** [February 6, 2022, 10:44am UTC](https://discuss.elastic.co/t/watcher-for-nodes-in-elasticsearch/296387 "2022-02-06T10:44:18Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Abhi\_Abhishek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abhi_abhishek/32/101426_2.png) [@Abhi\_Abhishek](https://discuss.elastic.co/u/Abhi_Abhishek)\ **Post date:** [February 6, 2022, 10:44am UTC](https://discuss.elastic.co/t/watcher-for-nodes-in-elasticsearch/296387/1 "2022-02-06T10:44:18Z")
Hello guys This I my first time working with watchers. Can anyone help me with building watcher for all Elasticsearch nodes are running or stopped that is we should get alert when the node is stopped or started. I need a watcher template for this issue. Thank you ---
**Author:** ![xeraa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xeraa/32/48181_2.png) [@xeraa](https://discuss.elastic.co/u/xeraa)\ **Post date:** [February 6, 2022, 6:25pm UTC](https://discuss.elastic.co/t/watcher-for-nodes-in-elasticsearch/296387/2 "2022-02-06T18:25:00Z")
Is there a reason why you're not trying to do that with [Kibana alerting](https://www.elastic.co/guide/en/kibana/current/kibana-alerts.html) where this is built in? Cluster alerting includes: > Elasticsearch nodes changed. You have Elasticsearch nodes that were recently added or removed. ---
**Author:** ![Abhi\_Abhishek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abhi_abhishek/32/101426_2.png) [@Abhi\_Abhishek](https://discuss.elastic.co/u/Abhi_Abhishek)\ **Post date:** [February 7, 2022, 6:02am UTC](https://discuss.elastic.co/t/watcher-for-nodes-in-elasticsearch/296387/3 "2022-02-07T06:02:15Z")
I need both methods. Can you help me by providing watcher template or videos or good documentation that's easy to understand. ---
**Author:** ![xeraa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xeraa/32/48181_2.png) [@xeraa](https://discuss.elastic.co/u/xeraa)\ **Post date:** [February 7, 2022, 9:24am UTC](https://discuss.elastic.co/t/watcher-for-nodes-in-elasticsearch/296387/4 "2022-02-07T09:24:16Z")
Something like [Watcher HTTP input | Elasticsearch Guide [7.17] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/7.17/input-http.html#_calling_elasticsearch_apis) would be a good starting point. Not sure I have seen a complete example for this scenario before. But start working with that and see how far you get. ---
**Author:** ![Abhi\_Abhishek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abhi_abhishek/32/101426_2.png) [@Abhi\_Abhishek](https://discuss.elastic.co/u/Abhi_Abhishek)\ **Post date:** [February 7, 2022, 11:20am UTC](https://discuss.elastic.co/t/watcher-for-nodes-in-elasticsearch/296387/5 "2022-02-07T11:20:39Z")
Yeah, Thank you I am working on this. ---
**Author:** ![Abhi\_Abhishek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abhi_abhishek/32/101426_2.png) [@Abhi\_Abhishek](https://discuss.elastic.co/u/Abhi_Abhishek)\ **Post date:** [February 7, 2022, 3:51pm UTC](https://discuss.elastic.co/t/watcher-for-nodes-in-elasticsearch/296387/6 "2022-02-07T15:51:35Z")
PUT \_watcher/watch/testing-watch { "trigger": { "schedule": { "interval": "10s" } }, "input": { "http": { "request": { "scheme": "https", "host": "[seaselk-dev-elastic.corp.chartercom.com](http://seaselk-dev-elastic.corp.chartercom.com)", "port": 443, "method": "get", "params": {}, "headers": {}, "auth": { "basic": { "username": "elastic", "password": "\***" } } } } }, "condition": { "always" : {} }, "actions": { "send\_writerequests\_email": { "email": { "profile": "standard", "to": [ "**" ], "subject": "Nodes status" } } } } This is getting an error ---
**Author:** ![Abhi\_Abhishek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abhi_abhishek/32/101426_2.png) [@Abhi\_Abhishek](https://discuss.elastic.co/u/Abhi_Abhishek)\ **Post date:** [February 7, 2022, 3:52pm UTC](https://discuss.elastic.co/t/watcher-for-nodes-in-elasticsearch/296387/7 "2022-02-07T15:52:33Z")
"type" : "s\_s\_l\_handshake\_exception", "reason" : "PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target", "caused\_by" : { "type" : "validator\_exception", "reason" : "PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target", "caused\_by" : { "type" : "sun\_cert\_path\_builder\_exception", "reason" : "unable to find valid certification path to requested target" } ---
**Author:** ![Abhi\_Abhishek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abhi_abhishek/32/101426_2.png) [@Abhi\_Abhishek](https://discuss.elastic.co/u/Abhi_Abhishek)\ **Post date:** [February 7, 2022, 3:53pm UTC](https://discuss.elastic.co/t/watcher-for-nodes-in-elasticsearch/296387/8 "2022-02-07T15:53:47Z")
Is their anyway without editing Elasticsearch.yml, we can skip the SSL handshake in watcher. ---
**Author:** ![xeraa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xeraa/32/48181_2.png) [@xeraa](https://discuss.elastic.co/u/xeraa)\ **Post date:** [February 9, 2022, 5:29pm UTC](https://discuss.elastic.co/t/watcher-for-nodes-in-elasticsearch/296387/9 "2022-02-09T17:29:17Z")
I'd try [Watcher settings in Elasticsearch | Elasticsearch Guide [7.17] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/notification-settings.html#ssl-notification-settings) — there is a `none` setting for TLS checking. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 9, 2022, 5:30pm UTC](https://discuss.elastic.co/t/watcher-for-nodes-in-elasticsearch/296387/10 "2022-03-09T17:30:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.