# Watcher take in account different queries

**URL:** <https://discuss.elastic.co/t/watcher-take-in-account-different-queries/199388>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [September 13, 2019, 8:25am UTC](https://discuss.elastic.co/t/watcher-take-in-account-different-queries/199388 "2019-09-13T08:25:56Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![victor.nilsson](https://avatars.discourse-cdn.com/v4/letter/v/eb8c5e/32.png) [@victor.nilsson](https://discuss.elastic.co/u/victor.nilsson)\
**Post date:** [September 13, 2019, 8:25am UTC](https://discuss.elastic.co/t/watcher-take-in-account-different-queries/199388/1 "2019-09-13T08:25:56Z")

</div>

Hi,

We have an index "Server-Index" where we sometimes get a string indexed with the contents "foo". A few seconds later some other messages will get indexed as well that is tied to the "foo" string above. What we want to do is to trigger if "foo" appears and then aggregate the nextcoming messages that are related to the "foo" string for 5 minutes. Is this possible?

For example:

12:00 we receive a message containing "foo" \<- Now we know something bad has happened and in a few seconds we will receive more messages that are related to the first message "foo".  
12:01 2 message arrive which contain more information  
12:02 4 more messages arrive which contain more information  
12:05 we send an alert containing the "foo" string along with all the information provided in the messages receivied thereafter.

Is this possible, if so, what should i be looking at?

Thanks

---

<div class="post-metadata">

**Author:** ![victor.nilsson](https://avatars.discourse-cdn.com/v4/letter/v/eb8c5e/32.png) [@victor.nilsson](https://discuss.elastic.co/u/victor.nilsson)\
**Post date:** [September 13, 2019, 9:42am UTC](https://discuss.elastic.co/t/watcher-take-in-account-different-queries/199388/2 "2019-09-13T09:42:38Z")

</div>

I have tried to use chain inputs but i cannot seem to get it quite right. I have come up with the following:

```
{
  "trigger": {
    "schedule": {
      "interval": "5m"
    }
  },
  "input": {
    "chain" : {
       "inputs" : [
           {
            "first": {
            "search": {
                "request": {
                "search_type": "query_then_fetch",
                "indices": [
                "logstash-server-*"
                ],
                "types": [],
                "body": {
                "size": 0,
                "query": {
                "bool": {
                    "filter": [
                    {
                        "range": {
                        "@timestamp": {
                        "from": "now-24h",
                        "to": "now"
                    }
                    }
                    },
                    {
                        "search": {
                        "message": "'vSphere HA detected a possible host failure of host'"
                    }
                    }
                    ]
                }
                }
                }
                }
                }
                },
                "second" : {
                    "search" : {
                        "message" : "'Virtual machine'"
                    }
                
            }
            }
            ]
          }
    },
  "condition": {
    "always": {}
  },
  "actions": {
    "email_admin": {
      "email": {
        "profile": "standard",
        "to": [
          "user@example.com"
        ],
        "subject": "Host-Restart-Test",
        "body": {
          "text": ""
        }
      }
    }
  }
}

```

When i run the code above i get the following error:

> [parse\_exception] Expected closing JSON object after parsing input [search] named [first] in watch [_inlined_]

What seems to be the issue?

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [September 16, 2019, 1:23pm UTC](https://discuss.elastic.co/t/watcher-take-in-account-different-queries/199388/3 "2019-09-16T13:23:49Z")

</div>

Hey,

while this might be possible with watcher and some advanced queries, I think the functionality you should take a closer look at, are [data frames](https://www.elastic.co/guide/en/elastic-stack-overview/7.3/ml-dataframes.html) as this allows you to summarize your data, even in a streaming fashion.

--Alex

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 14, 2019, 1:23pm UTC](https://discuss.elastic.co/t/watcher-take-in-account-different-queries/199388/4 "2019-10-14T13:23:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.