# Watcher template for terms with no data

**URL:** <https://discuss.elastic.co/t/watcher-template-for-terms-with-no-data/289490>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting\
**Created:** [November 17, 2021, 5:56pm UTC](https://discuss.elastic.co/t/watcher-template-for-terms-with-no-data/289490 "2021-11-17T17:56:38Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![GavinBeattie](https://avatars.discourse-cdn.com/v4/letter/g/5f9b8f/32.png) [@GavinBeattie](https://discuss.elastic.co/u/GavinBeattie)\
**Post date:** [November 17, 2021, 5:56pm UTC](https://discuss.elastic.co/t/watcher-template-for-terms-with-no-data/289490/1 "2021-11-17T17:56:38Z")

</div>

Hi,

I would like a watcher alert (released as an email) that identifies vehicles with no data, for example:

vehicles = ["abc", "def", "ghi"] show vehicles with no data in past 7 days.

I could count those that have occurred in the last 3 days, but how can I include my vehicles in the query or as part of the output for the ones that have zero records.

What I had in mind was a html table and a bit of script that could hide if the vehicle was in the ctx.payload or leave showing if no data. Essentially, like an inverse, so:

abc. count 0 - line visible  
def. count 1 - line hidden  
ghi. count 0 - line visible

There are quite a lot of vehicles, so I don't want to create lots of cloned Watcher alerts.  
Watcher 1: name = abc., Watcher 2: name = def., Watcher 3: name = ghi, etc.

As an alternative I wondered if it is possible to loop a very long parameter and include the parameter in the body of the email.

Ideas welcome.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 15, 2021, 5:56pm UTC](https://discuss.elastic.co/t/watcher-template-for-terms-with-no-data/289490/2 "2021-12-15T17:56:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
