# Watcher matching isn't working - any help?

**URL:** https://discuss.elastic.co/t/watcher-matching-isnt-working-any-help/26960
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [August 6, 2015, 10:43am UTC](https://discuss.elastic.co/t/watcher-matching-isnt-working-any-help/26960 "2015-08-06T10:43:55Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![dmccuk](https://avatars.discourse-cdn.com/v4/letter/d/3d9bf3/32.png) [@dmccuk](https://discuss.elastic.co/u/dmccuk)
#### Post date: [August 6, 2015, 10:43am UTC](https://discuss.elastic.co/t/watcher-matching-isnt-working-any-help/26960/1 "2015-08-06T10:43:55Z")

</div>

I'm trying to evaluate watcher as a replacement for an application that monitors our syslog. This is probably the biggest use case for watcher out there.

I need to match multiple specific strings (in separate watches) and then alert on them.

I've set up a simple watch to match for a condition but i get back not only the condition I'm looking for but an attachment with several other conditions in. Is this how watcher works? I guess I've made a mistake somewhere. Here's my watch configuration. Can anyone recommend what i can do to get it working?

Here is the watch:

```
curl -XPUT 'http://localhost:9200/_watcher/watch/log_error_watch' -d '{
  "trigger" : {
    "schedule" : { "interval" : "10s" } 
  },
  "input" : {
    "search" : {
      "request" : {
        "indices" : ["logstash-2015. **.**"],
        "body" : {
          "query" : {
            "match" : { "message": "alloc: /backup: file system full" }
          }
        }
      }
    }
  },
  "condition" : {
    "compare" : { "ctx.payload.hits.total" : { "gt" : 0 }} 
  },
  "actions" : {
    "send_email" : {
      "email" : {
        "to" : "me@me.com>",
        "subject" : "Filesystem Warning from Watcher",
        "body" : "TEST MESSAGE: /backup: file system full",
        "attach_data" : true
      }
    }
  }
}'

```

I’m unable to share the attached file due to the nature of its contents.

Email works ok.

Thanks for any pointers you can give me.

---

<div class="post-metadata">

### Author: ![mvg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mvg/32/98890_2.png) [@mvg](https://discuss.elastic.co/u/mvg)
#### Post date: [August 6, 2015, 3:18pm UTC](https://discuss.elastic.co/t/watcher-matching-isnt-working-any-help/26960/2 "2015-08-06T15:18:39Z")

</div>

The match query will match if any of the terms occur in a document with the message field. You can set the `operator` option on the match query to `and`, so that all all terms are required to match.

But I think you're looking for a phrase match instead? Then you should try out the `match_phrase` query instead.

---

<div class="post-metadata">

### Author: ![dmccuk](https://avatars.discourse-cdn.com/v4/letter/d/3d9bf3/32.png) [@dmccuk](https://discuss.elastic.co/u/dmccuk)
#### Post date: [August 13, 2015, 1:16pm UTC](https://discuss.elastic.co/t/watcher-matching-isnt-working-any-help/26960/3 "2015-08-13T13:16:51Z")

</div>

Hi,

I changed it to match\_query and it worked! Thanks very much.

I have a question on how to only alert (with watcher) on new matches but I'll raise another topic for it.

Regards

Dennis

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:49pm UTC](https://discuss.elastic.co/t/watcher-matching-isnt-working-any-help/26960/4 "2017-07-06T13:49:00Z")

</div>