# Watcher Question

**URL:** <https://discuss.elastic.co/t/watcher-question/229168>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [April 22, 2020, 3:38am UTC](https://discuss.elastic.co/t/watcher-question/229168 "2020-04-22T03:38:33Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![namar321](https://avatars.discourse-cdn.com/v4/letter/n/4af34b/32.png) [@namar321](https://discuss.elastic.co/u/namar321)\
**Post date:** [April 22, 2020, 3:38am UTC](https://discuss.elastic.co/t/watcher-question/229168/1 "2020-04-22T03:38:33Z")

</div>

We would like to set up a watcher to continuously compare the latest sum of values by location and alert if the latest set of values are more than two standard deviations above historical data. The following is not working as expected.

```auto
PUT _watcher/watch/mywatcher
{
  "trigger": {
    "schedule": {
      "interval": "30s"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "myindex"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "filter": [
                {
                  "range": {
                    "@timestamp": {
                      "from": "now-10d",
                      "to": "now"
                    }
                  }
                },
                {
                  "terms": {
                    "result_type": [
                      "bucket",
                      "record",
                      "influencer"
                    ]
                  }
                }
              ]
            }
          },
          "aggs": {
            "five_minutes": {
              "filters": {
                "filters": {
                  "latest15minutes": {
                    "range": {
                      "@timestamp": {"gte": "now-15m", "lte": "now"}
                      
                    }
                    
                  },
                  "previous6days":{
                    "range": {
                      "@timestamp": {"gte": "now-6d", "lte": "now-15m"}
                    }
                    
                  }
                  
                }
                
              },
              "aggs": {
                "bylocation": {
                  "terms": {
                    "field": "location"
                    },
                    "aggs":{
                      "avgvalues": {
                        "avg": {
                          "field": "val"
                          
                        }
                        
                      }
                      
                    }
                }
                
              }
                
              }
              
            }
            
          }
          
        }
        
      }
  },
  "condition": {
    "script": {
      "inline": "return ctx.payload.aggregations.five_minutes.buckets.latest15minutes.avgvalues.value > 2 * ctx.payload.aggregations.five_minutes.buckets.previous6days.avgvalues.value"
      
    }
  },
  "actions": {
    "log": {
      "logging": {
        "level": "info",
        "text": "Alert for job [{{ctx.payload.aggregations.five_minutes.buckets.latest15minutes.avgvalues}}]"
      }
    }    
  }  
}  

```

---

<div class="post-metadata">

**Author:** ![namar321](https://avatars.discourse-cdn.com/v4/letter/n/4af34b/32.png) [@namar321](https://discuss.elastic.co/u/namar321)\
**Post date:** [April 27, 2020, 3:21am UTC](https://discuss.elastic.co/t/watcher-question/229168/2 "2020-04-27T03:21:25Z")

</div>

Fixed.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 25, 2020, 3:29am UTC](https://discuss.elastic.co/t/watcher-question/229168/3 "2020-05-25T03:29:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.