# Watcher Parse Exception Unknown Input Type Condition

**URL:** <https://discuss.elastic.co/t/watcher-parse-exception-unknown-input-type-condition/150242>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [September 27, 2018, 7:00pm UTC](https://discuss.elastic.co/t/watcher-parse-exception-unknown-input-type-condition/150242 "2018-09-27T19:00:19Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jc034240](https://avatars.discourse-cdn.com/v4/letter/j/977dab/32.png) [@jc034240](https://discuss.elastic.co/u/jc034240)\
**Post date:** [September 27, 2018, 7:00pm UTC](https://discuss.elastic.co/t/watcher-parse-exception-unknown-input-type-condition/150242/1 "2018-09-27T19:00:19Z")

</div>

When trying to create a watch I'm receiving:  
Watcher: [parse\_exception] could not parse input for watch [_watch name_]. unknown input type [condition]

I have put the below in a JSON formatter to help ensure validity.

My Watcher:

> ```
> {  
> "trigger":{  
> "schedule":{  
> "interval":"5m"
> }
> },
> "input":{  
> "search":{  
> "request":{  
> "indices":"my_index_name*",
> "body":{  
> "query":{  
> "bool":{  
> "must":[  
> {  
> "query_string":{"query":"fieldName:(\"1234\" OR \"5678\") AND fieldName2:*Password*"}
> },
> {  
> "range":{  
> "@timestamp":{  
> "from":"now-24h",
> "to":"now"
> }
> }
> }
> ]
> }
> }
> }
> }
> },
> "condition":{  
> "compare":{  
> "ctx.payload.hits.total":{  
> "gt":0
> }
> }
> },
> "actions":{  
> "reminder_email":{  
> "email":{  
> "profile":"standard",
> "to":[  
> "some_guy@domain.com"
> ],
> "subject":"Adverse Stuff",
> "body":{  
> "text":"Dear {{ctx.payload.name}}, Adverse stuff may have been configured. Please investigate."
> }
> }
> }
> }
> }
> }
> 
> ```

---

<div class="post-metadata">

**Author:** ![elastock](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elastock/32/35672_2.png) [@elastock](https://discuss.elastic.co/u/elastock)\
**Post date:** [September 27, 2018, 11:49pm UTC](https://discuss.elastic.co/t/watcher-parse-exception-unknown-input-type-condition/150242/2 "2018-09-27T23:49:29Z")

</div>

> [@jc034240](#):
>
> { "trigger":{ "schedule":{ "interval":"5m" } }, "input":{ "search":{ "request":{ "indices":"my\_index\_name\*", "body":{ "query":{ "bool":{ "must":[{ "query\_string":{"query":"fieldName:("1234" OR "5678") AND fieldName2:_Password_"} }, { "range":{ "@timestamp":{ "from":"now-24h", "to":"now" } } }] } } } } }, "condition":{ "compare":{ "ctx.payload.hits.total":{ "gt":0 } } }, "actions":{ "reminder\_email":{ "email":{ "profile":"standard", "to":["[some\_guy@domain.com](mailto:some_guy@domain.com)" ], "subject":"Adverse Stuff", "body":{ "text":"Dear {{ctx.payload.name}}, Adverse stuff may have been configured. Please investigate." } } } } } }

your JSON is not correct because your condition is inside the input .

Correct version :

> ```
> {
> "trigger": {
> "schedule": {
> "interval": "5m"
> }
> },
> "input": {
> "search": {
> "request": {
> "indices": "my_index_name*",
> "body": {
> "query": {
> "bool": {
> "must": [
> {
> "query_string": {
> "query": "fieldName:(\"1234\" OR \"5678\") AND fieldName2:*Password*"
> }
> },
> {
> "range": {
> "@timestamp": {
> "from": "now-24h",
> "to": "now"
> }
> }
> }
> ]
> }
> }
> }
> }
> }
> },
> "condition": {
> "compare": {
> "ctx.payload.hits.total": {
> "gt": 0
> }
> }
> },
> "actions": {
> "reminder_email": {
> "email": {
> "profile": "standard",
> "to": [
> "some_guy@domain.com"
> ],
> "subject": "Adverse Stuff",
> "body": {
> "text": "Dear {{ctx.payload.name}}, Adverse stuff may have been configured. Please investigate."
> }
> }
> }
> }
> }
> 
> ```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 25, 2018, 11:49pm UTC](https://discuss.elastic.co/t/watcher-parse-exception-unknown-input-type-condition/150242/3 "2018-10-25T23:49:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.