# Watcher mutilple actions and conditions **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-alerting\ **Created:** [October 10, 2019, 6:21am UTC](https://discuss.elastic.co/t/watcher-mutilple-actions-and-conditions/202951 "2019-10-10T06:21:48Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Sajal](https://avatars.discourse-cdn.com/v4/letter/s/96bed5/32.png) [@Sajal](https://discuss.elastic.co/u/Sajal)\ **Post date:** [October 10, 2019, 6:21am UTC](https://discuss.elastic.co/t/watcher-mutilple-actions-and-conditions/202951/1 "2019-10-10T06:21:48Z")
Hi Team , I am using watcher for calling webhook and email , it is working perfectly fine . But i need to apply one more condition and depending on that condition i want to call different email which is different from first one . I want to check if data is coming in metricbeat or not . where to add second condition and it's action ? Please find below working watcher script PUT \_watcher/watch/sajal { "trigger" : { "schedule" : { "interval" : "1m" } }, "input" : { "search": { "request": { "indices": "metricbeat-\*", "body": { "query": { "bool": { "must": [ { "match": { "system.filesystem.mount\_point":"/u02"} }, { "range": { "system.filesystem.used.pct":{"gte": "0.70"} } } ], "filter": [ { "range": { "@timestamp": { "from": "now-60s", "to": "now" } } } ] } } } } } }, "condition" : { "compare" : { "ctx.payload.hits.total" : { "gt" : 0 }} }, "actions" : { "email\_administrator" : { "email" : { "to" : "Sajal\_Sachan@Dellteam.com", "subject" : "Encountered {{ctx.payload.hits.total}} errors", "body" : "Error in the system, see attached data", "priority" : "high" } } } } ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [October 11, 2019, 12:36pm UTC](https://discuss.elastic.co/t/watcher-mutilple-actions-and-conditions/202951/2 "2019-10-11T12:36:43Z")
Hey, so instead of using a `compare` condition you can use a `script` condition. Scripting allows you to check arbitrary things based on whatever logic you have in mind and thus is extremely customizable. Regarding the recipient: Within your condition you could add an additional snippet, that sets a field like `ctx.payload.email_recipient = "foo@bar"` - and of course you can set the recipient based on any `if` condition you like within your script. This would allow you to set `"to" : "{{ctx.payload.email_recipient}}"` in your email and have a dynamic recipient. Hope this helps! --Alex ---
**Author:** ![Sajal](https://avatars.discourse-cdn.com/v4/letter/s/96bed5/32.png) [@Sajal](https://discuss.elastic.co/u/Sajal)\ **Post date:** [October 11, 2019, 9:30pm UTC](https://discuss.elastic.co/t/watcher-mutilple-actions-and-conditions/202951/3 "2019-10-11T21:30:33Z")
Thanks Alex, Can you just help me in below requirement ? I want to check if data is not coming in metricbeat index . So i want to place condition ctx.payload.hits.total" : { "eq" : 0 } . And when this condition mets then it should call another email saying metricbeat data is not coming . I want to add this part in working watcher script . How i should add this part ? ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [October 14, 2019, 10:08am UTC](https://discuss.elastic.co/t/watcher-mutilple-actions-and-conditions/202951/4 "2019-10-14T10:08:15Z")
hey. what about two watches? one with a condition check for zero hits and one with another check then running different actions? --Alex ---
**Author:** ![Sajal](https://avatars.discourse-cdn.com/v4/letter/s/96bed5/32.png) [@Sajal](https://discuss.elastic.co/u/Sajal)\ **Post date:** [October 14, 2019, 10:20am UTC](https://discuss.elastic.co/t/watcher-mutilple-actions-and-conditions/202951/5 "2019-10-14T10:20:00Z")
I want to use only single watch . Is that possible ? ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [October 14, 2019, 12:09pm UTC](https://discuss.elastic.co/t/watcher-mutilple-actions-and-conditions/202951/6 "2019-10-14T12:09:51Z")
it is possible by specifying a condition for each action. I'd personally not do it though to keep a single watch more readable. ---
**Author:** ![Sajal](https://avatars.discourse-cdn.com/v4/letter/s/96bed5/32.png) [@Sajal](https://discuss.elastic.co/u/Sajal)\ **Post date:** [October 14, 2019, 12:28pm UTC](https://discuss.elastic.co/t/watcher-mutilple-actions-and-conditions/202951/7 "2019-10-14T12:28:57Z")
By creating two watcher , impact on CPU will be double or it will be same as if we use two conditions in same watcher ? ---
**Author:** ![Sajal](https://avatars.discourse-cdn.com/v4/letter/s/96bed5/32.png) [@Sajal](https://discuss.elastic.co/u/Sajal)\ **Post date:** [October 14, 2019, 6:57pm UTC](https://discuss.elastic.co/t/watcher-mutilple-actions-and-conditions/202951/8 "2019-10-14T18:57:31Z")
Hi Alexander , Can you please help me to add other condition in same watcher ? I want to check if data is not coming in metricbeat index . So i want to place condition ctx.payload.hits.total" : { "eq" : 0 } . And when this condition mets then it should call another email saying metricbeat data is not coming . Working watcher script is given in above messages. Please help me to add other condition in same watcher . ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 11, 2019, 6:57pm UTC](https://discuss.elastic.co/t/watcher-mutilple-actions-and-conditions/202951/9 "2019-11-11T18:57:44Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.