# Watcher - Only Alert Once Based on Specific Field

**URL:** <https://discuss.elastic.co/t/watcher-only-alert-once-based-on-specific-field/357004>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting\
**Created:** [April 8, 2024, 5:24pm UTC](https://discuss.elastic.co/t/watcher-only-alert-once-based-on-specific-field/357004 "2024-04-08T17:24:34Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![erikg](https://avatars.discourse-cdn.com/v4/letter/e/91b2a8/32.png) [@erikg](https://discuss.elastic.co/u/erikg)\
**Post date:** [April 8, 2024, 5:24pm UTC](https://discuss.elastic.co/t/watcher-only-alert-once-based-on-specific-field/357004/1 "2024-04-08T17:24:34Z")

</div>

Hello,

So I understand scheduling a csv report is only possible currently with Watcher.  
My use case is I want to send a csv report based on user.name when a condition has been met.

The issue is the condition will be met more than once. I want to know how Watcher can alert only once based on user.name, and even though the condition is still being met, to not alert after the first time.

Thanks,  
Erik

---

<div class="post-metadata">

**Author:** ![bhavyarm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhavyarm/32/22392_2.png) [@bhavyarm](https://discuss.elastic.co/u/bhavyarm)\
**Post date:** [April 10, 2024, 7:25am UTC](https://discuss.elastic.co/t/watcher-only-alert-once-based-on-specific-field/357004/2 "2024-04-10T07:25:07Z")

</div>

@alisongoryachev can this user get some help please?

Thanks,  
Bhavya

---

<div class="post-metadata">

**Author:** ![alisongoryachev](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alisongoryachev/32/111352_2.png) [@alisongoryachev](https://discuss.elastic.co/u/alisongoryachev)\
**Post date:** [April 12, 2024, 7:05pm UTC](https://discuss.elastic.co/t/watcher-only-alert-once-based-on-specific-field/357004/3 "2024-04-12T19:05:01Z")

</div>

Hi @erikg! I don't think there is a way to achieve this OOTB. I would recommend looking into leveraging a Painless script.

Docs: [Watcher condition context | Painless Scripting Language [8.13] | Elastic](https://www.elastic.co/guide/en/elasticsearch/painless/current/painless-watcher-condition-context.html)

This is also a similar post with suggestions: [Alert Notification just once](https://discuss.elastic.co/t/alert-notification-just-once/256030)

---

<div class="post-metadata">

**Author:** ![erikg](https://avatars.discourse-cdn.com/v4/letter/e/91b2a8/32.png) [@erikg](https://discuss.elastic.co/u/erikg)\
**Post date:** [April 15, 2024, 2:10pm UTC](https://discuss.elastic.co/t/watcher-only-alert-once-based-on-specific-field/357004/4 "2024-04-15T14:10:53Z")

</div>

Hey @alisongoryachev , thanks!

I will look into this, is there any plans to add this capability as a built-in feature?