# Watcher that counts the documents that arrive to an index in kibana

**URL:** <https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [April 19, 2021, 4:45pm UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609 "2021-04-19T16:45:55Z")\
**Posts on this page:** 20\
**Page:** 2

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 23, 2021, 11:34pm UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/21 "2021-04-23T23:34:26Z")

</div>

found it!!! You beat me... that is because the aggregation is not inside the "hits" we need to be explicit with the field name

In the condition.

```auto
  "condition": {
    "compare": {
      "ctx.payload.aggregations.heartbeat_count.value": {
        "gte": 1000
      }
    }
  }

```

And Action should be

```
  "actions": {
    "notify-slack": {
      "slack": {
        "message": {
          "to": [
            "#stephenb-es-integration"
          ],
          "text": "Encountered {{ctx.payload.aggregations.heartbeat_count.value}} heartbeats in the last 1 day (facepalm)"
        }
      }
    }
  }
}

```

I will fix above!

Results

```auto
{
  "watch_id": "_inlined_",
  "node": "6FBy_sIiSGONVnQZ5O8GkA",
  "state": "executed",
  "user": "elastic",
  "status": {
    "state": {
      "active": true,
      "timestamp": "2021-04-23T23:35:37.938Z"
    },
    "last_checked": "2021-04-23T23:35:37.938Z",
    "last_met_condition": "2021-04-23T23:35:37.938Z",
    "actions": {
      "notify-slack": {
        "ack": {
          "timestamp": "2021-04-23T23:35:37.938Z",
          "state": "ackable"
        },
        "last_execution": {
          "timestamp": "2021-04-23T23:35:37.938Z",
          "successful": true
        },
        "last_successful_execution": {
          "timestamp": "2021-04-23T23:35:37.938Z",
          "successful": true
        }
      }
    },
    "execution_state": "executed",
    "version": -1
  },
  "trigger_event": {
    "type": "manual",
    "triggered_time": "2021-04-23T23:35:37.938Z",
    "manual": {
      "schedule": {
        "scheduled_time": "2021-04-23T23:35:37.938Z"
      }
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "heartbeat-*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "filter": [
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-1d/d",
                      "lt": "now/d"
                    }
                  }
                }
              ]
            }
          },
          "aggs": {
            "heartbeat_count": {
              "value_count": {
                "field": "_index"
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.aggregations.heartbeat_count.value": {
        "gte": 1000
      }
    }
  },
  "metadata": {
    "name": "test-heartbeat-watcher",
    "xpack": {
      "type": "json"
    }
  },
  "result": {
    "execution_time": "2021-04-23T23:35:37.938Z",
    "execution_duration": 262,
    "input": {
      "type": "search",
      "status": "success",
      "payload": {
        "_shards": {
          "total": 11,
          "failed": 0,
          "successful": 11,
          "skipped": 0
        },
        "hits": {
          "hits": [],
          "total": 10000,
          "max_score": null
        },
        "took": 14,
        "timed_out": false,
        "aggregations": {
          "heartbeat_count": {
            "value": 60474
          }
        }
      },
      "search": {
        "request": {
          "search_type": "query_then_fetch",
          "indices": [
            "heartbeat-*"
          ],
          "rest_total_hits_as_int": true,
          "body": {
            "size": 0,
            "query": {
              "bool": {
                "filter": [
                  {
                    "range": {
                      "@timestamp": {
                        "gte": "now-1d/d",
                        "lt": "now/d"
                      }
                    }
                  }
                ]
              }
            },
            "aggs": {
              "heartbeat_count": {
                "value_count": {
                  "field": "_index"
                }
              }
            }
          }
        }
      }
    },
    "condition": {
      "type": "compare",
      "status": "success",
      "met": true,
      "compare": {
        "resolved_values": {
          "ctx.payload.aggregations.heartbeat_count.value": 60474
        }
      }
    },
    "actions": [
      {
        "id": "notify-slack",
        "type": "slack",
        "status": "success",
        "slack": {
          "account": "monitoring",
          "sent_messages": [
            {
              "status": "success",
              "to": "#stephenb-es-integration",
              "message": {
                "from": "x-pack",
                "icon": "http://example.com/images/watcher-icon.jpg",
                "text": "Encountered 60474 heartbeats in the last 1 day (facepalm)"
              }
            }
          ]
        }
      }
    ]
  },
  "messages": []
}

```

---

<div class="post-metadata">

**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Post date:** [April 23, 2021, 11:35pm UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/22 "2021-04-23T23:35:19Z")

</div>

> [@stephenb](#):
>
> `{{ctx.payload.aggregations.heartbeat_count.value}}`

but it doesn't show up in the mail action  
☹

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 23, 2021, 11:36pm UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/23 "2021-04-23T23:36:56Z")

</div>

It does... go back and go slow... mine just showed up in slack.

Do the simulate and force the action...

Show me your email action again.

---

<div class="post-metadata">

**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Post date:** [April 23, 2021, 11:36pm UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/24 "2021-04-23T23:36:58Z")

</div>

```auto
"actions": [
      {
        "id": "email_1",
        "type": "email",
        "status": "simulated",
        "email": {
          "message": {
            "id": "email_1 __inlined__ 64096482-0d81-43e6-abba-947a6aa2cc67-2021-04-23T23:36:17.648901Z_26879",
            "sent_date": "2021-04-23T23:36:17.658797Z",
            "to": [
              "victor.vera@megadvantage.com",
              "juan.jaramillo@megadvantage.com",
              "andres.molinac.pr@etb.com.co",
              "juan.ariasp1.pr@etb.com.co"
            ],
            "bcc": [
              "juancho.jaramillo16@gmail.com"
            ],
            "subject": "Estado herramienta monitoreo",
            "body": {
              "text": "Buen dia, \n\n ⚠La herramienta de monitoreo a funcionado correctamente en las ultimas 24 horas \n \n Estado: UP🟢 \n\n 🕧Hora: 2021-04-23 18:36:17 \n\n Área: Networking \n \n🔔Mensaje Alerta: Por favor no responder a este mensaje \n\n "
            }
          }
        }
      }
    ]
  },
  "messages": []
}

```

---

<div class="post-metadata">

**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Post date:** [April 23, 2021, 11:37pm UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/25 "2021-04-23T23:37:29Z")

</div>

this is the action:

```auto
"actions": {
    "email_1": {
      "email": {
        "profile": "standard",
        "attach_data": {
          "format": "yaml"
        },
        "to": [
          "victor.vera@megadvantage.com",
          "juan.jaramillo@megadvantage.com",
          "andres.molinac.pr@etb.com.co",
          "juan.ariasp1.pr@etb.com.co"
        ],
        "bcc": [
          "juancho.jaramillo16@gmail.com"
        ],
        "subject": "{{ctx.metadata.name}}",
        "body": {
          "text": """Buen dia, 

 ⚠La herramienta de monitoreo a funcionado correctamente en las ultimas 24 horas {{ctx.payload.aggregations.heartbeat_count.value}}
 
 Estado: UP🟢 

 🕧Hora: {{ctx.payload.time_triggered}} {{ctx.result.execution_time}}

 Área: Networking 
 
🔔Mensaje Alerta: Por favor no responder a este mensaje 

 """
        }
      }
    }
  },

```

---

<div class="post-metadata">

**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Post date:** [April 23, 2021, 11:39pm UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/26 "2021-04-23T23:39:01Z")

</div>

does not show it in the mail:

```auto
 "actions": [
      {
        "id": "email_1",
        "type": "email",
        "status": "simulated",
        "email": {
          "message": {
            "id": "email_1 __inlined__ 48c2b07b-4996-4d22-9cfe-34bac4cd8ac3-2021-04-23T23:38:30.195799Z_26880",
            "sent_date": "2021-04-23T23:38:30.205315Z",
            "to": [
              "victor.vera@megadvantage.com",
              "juan.jaramillo@megadvantage.com",
              "andres.molinac.pr@etb.com.co",
              "juan.ariasp1.pr@etb.com.co"
            ],
            "bcc": [
              "juancho.jaramillo16@gmail.com"
            ],
            "subject": "Estado herramienta monitoreo",
            "body": {
              "text": "Buen dia, \n\n ⚠La herramienta de monitoreo a funcionado correctamente en las ultimas 24 horas \n \n Estado: UP🟢 \n\n 🕧Hora: 2021-04-23 18:38:30 \n\n Área: Networking \n \n🔔Mensaje Alerta: Por favor no responder a este mensaje \n\n "
            }
          }
        }
      }
    ]
  },
  "messages": []
}

```

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 23, 2021, 11:39pm UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/27 "2021-04-23T23:39:32Z")

</div>

can you test a simple body without all the punctuation first like

`"text": "Encountered {{ctx.payload.aggregations.heartbeat_count.value}} heartbeats in the last 1 day"`

---

<div class="post-metadata">

**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Post date:** [April 23, 2021, 11:40pm UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/28 "2021-04-23T23:40:49Z")

</div>

> [@stephenb](#):
>
> "text": "Encountered {{ctx.payload.aggregations.heartbeat\_count.value}} heartbeats in the last 1 day"

Like this?

```auto
 "actions": {
    "email_1": {
      "email": {
        "profile": "standard",
        "attach_data": {
          "format": "yaml"
        },
        "to": [
          "victor.vera@megadvantage.com",
          "juan.jaramillo@megadvantage.com",
          "andres.molinac.pr@etb.com.co",
          "juan.ariasp1.pr@etb.com.co"
        ],
        "bcc": [
          "juancho.jaramillo16@gmail.com"
        ],
        "subject": "{{ctx.metadata.name}}",
        "body": {
          "text": "Encountered {{ctx.payload.aggregations.heartbeat_count.value}} heartbeats in the last 1 day"
        }
      }
    }
  },

```

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 23, 2021, 11:42pm UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/29 "2021-04-23T23:42:17Z")

</div>

I just sent your text to slack looks like this and I see the number

Buen dia,  
⚠La herramienta de monitoreo a funcionado correctamente en las ultimas 24 horas 60474

Estado: UP:large\_green\_circle:  
🕧Hora:  
Área: Networking

🔔Mensaje Alerta: Por favor no responder a este mensaje

---

<div class="post-metadata">

**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Post date:** [April 23, 2021, 11:43pm UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/30 "2021-04-23T23:43:42Z")

</div>

no good, nothing appears

```auto
 "actions": [
      {
        "id": "email_1",
        "type": "email",
        "status": "simulated",
        "email": {
          "message": {
            "id": "email_1 __inlined__ 86e47b0a-e497-41e0-83bf-ff852ce4346b-2021-04-23T23:41:10.833199Z_26881",
            "sent_date": "2021-04-23T23:41:10.845017Z",
            "to": [
              "victor.vera@megadvantage.com",
              "juan.jaramillo@megadvantage.com",
              "andres.molinac.pr@etb.com.co",
              "juan.ariasp1.pr@etb.com.co"
            ],
            "bcc": [
              "juancho.jaramillo16@gmail.com"
            ],
            "subject": "Estado herramienta monitoreo",
            "body": {
              "text": "Encountered heartbeats in the last 1 day"
            }
          }
        }
      }
    ]
  },
  "messages": []
}

```

---

<div class="post-metadata">

**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Post date:** [April 23, 2021, 11:44pm UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/31 "2021-04-23T23:44:23Z")

</div>

what error is it? it doesn't work for me ☹

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 23, 2021, 11:44pm UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/32 "2021-04-23T23:44:26Z")

</div>

Something else is going on let me look close

My Slack 🙂

 ![Screen Shot 2021-04-23 at 4.43.48 PM](https://us1.discourse-cdn.com/elastic/original/3X/0/c/0ced2231d83ed6c0f8e417fd78120c3d60f62c8e.png)

---

<div class="post-metadata">

**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Post date:** [April 23, 2021, 11:45pm UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/33 "2021-04-23T23:45:35Z")

</div>

I am sending you the whole code for your review:

```auto
{
  "trigger": {
    "schedule": {
      "daily": {
        "at": [
          "14:00"
        ]
      }
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "heartbeat*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "filter": [
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-1d/d",
                      "lt": "now/d"
                    }
                  }
                }
              ]
            }
          },
          "aggs": {
            "heartbeat_count": {
              "value_count": {
                "field": "_index"
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.aggregations.heartbeat_count.value": {
        "gte": 1000
      }
    }
  },
  "actions": {
    "email_1": {
      "email": {
        "profile": "standard",
        "attach_data": {
          "format": "yaml"
        },
        "to": [
          "victor.vera@megadvantage.com",
          "juan.jaramillo@megadvantage.com",
          "andres.molinac.pr@etb.com.co",
          "juan.ariasp1.pr@etb.com.co"
        ],
        "bcc": [
          "juancho.jaramillo16@gmail.com"
        ],
        "subject": "{{ctx.metadata.name}}",
        "body": {
          "text": "Encountered {{ctx.payload.aggregations.heartbeat_count.value}} heartbeats in the last 1 day"
        }
      }
    }
  },
  "transform": {
    "script": {
      "source": "return ['time_triggered': Instant.ofEpochMilli(ctx.trigger.triggered_time.getMillis()).atZone(ZoneId.of('America/Bogota')).format(DateTimeFormatter.ofPattern('YYYY-MM-dd HH:mm:ss'))];",
      "lang": "painless"
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 23, 2021, 11:58pm UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/34 "2021-04-23T23:58:44Z")

</div>

To Test

```auto
  "trigger": {
    "schedule": {
      "interval": "15s"
    }
  },

```

To test take out that transform script at the bottom can try that later.

```auto
,
  "transform": {
    "script": {
      "source": "return ['time_triggered': Instant.ofEpochMilli(ctx.trigger.triggered_time.getMillis()).atZone(ZoneId.of('America/Bogota')).format(DateTimeFormatter.ofPattern('YYYY-MM-dd HH:mm:ss'))];",
      "lang": "painless"
    }
  }

```

so just try this (put the simple email back in).  
Email just to you (are you spamming your friends 🙂 )

```
 {
  "trigger": {
    "schedule": {
      "interval": "15s"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "heartbeat-*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "filter": [
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-1d/d",
                      "lt": "now/d"
                    }
                  }
                }
              ]
            }
          },
          "aggs": {
            "heartbeat_count": {
              "value_count": {
                "field": "_index"
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.aggregations.heartbeat_count.value": {
        "gte": 1000
      }
    }
  },
  "actions": {
    "notify-slack": {
      "slack": {
        "message": {
          "to": [
            "#stephenb-es-integration"
          ],
          "text": "{{ctx.metadata.name}} : Encountered {{ctx.payload.aggregations.heartbeat_count.value}} heartbeats in the last 1 day"
        }
      }
    }
  }
}

```

My output

> [4:58]  
> test-heartbeat-watcher : Encountered 60474 heartbeats in the last 1 day
> 
> [4:58]  
> test-heartbeat-watcher : Encountered 60474 heartbeats in the last 1 day
> 
> [4:58]  
> test-heartbeat-watcher : Encountered 60474 heartbeats in the last 1 day
> 
> [4:59]  
> test-heartbeat-watcher : Encountered 60474 heartbeats in the last 1 day

@Juan_David_Jaramillo I need to step out for a bit... you are close....

---

<div class="post-metadata">

**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Post date:** [April 24, 2021, 12:05am UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/35 "2021-04-24T00:05:56Z")

</div>

Thank you, it was indeed because of the script that I did not get it.  
But now I have a problem, I can't use the script? ☹

```auto
"actions": [
      {
        "id": "email_1",
        "type": "email",
        "status": "simulated",
        "email": {
          "message": {
            "id": "email_1 __inlined__ bf91ec99-e03d-4917-8f25-483335fc9da2-2021-04-24T00:04:05.187357Z_26886",
            "sent_date": "2021-04-24T00:04:05.201541Z",
            "to": [
              "victor.vera@megadvantage.com",
              "juan.jaramillo@megadvantage.com"
            ],
            "bcc": [
              "juancho.jaramillo16@gmail.com"
            ],
            "subject": "Estado herramienta monitoreo",
            "body": {
              "text": "Buen dia, \n\n ⚠La herramienta de monitoreo a funcionado correctamente en las ultimas 24 horas \n \n there are 82076 documents in your index. Threshold is 1000.\n \n Estado: UP🟢 \n\n 🕧Hora: \n\n Área: Networking \n \n🔔Mensaje Alerta: Por favor no responder a este mensaje \n\n "
            }
          }
        }
      }
    ]
  },

```

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 24, 2021, 12:07am UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/36 "2021-04-24T00:07:52Z")

</div>

Yay ! 🙂

The Script... Perhaps.... Probably and error in the script.... Perhaps I can take a look later.

What are you actually trying to do with the script?

Are You just trying to display the triggered time in the correct time zone?

---

<div class="post-metadata">

**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Post date:** [April 24, 2021, 12:08am UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/37 "2021-04-24T00:08:51Z")

</div>

yes,I need to display the actual time in my time zone.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 24, 2021, 12:16am UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/38 "2021-04-24T00:16:55Z")

</div>

Yes OK... I am sure we can figure that out.

Someone with painless might be faster... so perhaps a new thread..

Or I will take a look later...

---

<div class="post-metadata">

**Author:** ![Juan\_David\_Jaramillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/juan_david_jaramillo/32/76831_2.png) [@Juan\_David\_Jaramillo](https://discuss.elastic.co/u/Juan_David_Jaramillo)\
**Post date:** [April 24, 2021, 12:18am UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/39 "2021-04-24T00:18:50Z")

</div>

ok, thanks, if it is important too, I need the real time because elasticsearch gives the wrong time, that's why I need the script.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 24, 2021, 12:20am UTC](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609/40 "2021-04-24T00:20:17Z")

</div>

Understood... it will be easy once we know the _"Encantamiento mágico"_

[Previous page](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609.md?page=1)

[Next page](https://discuss.elastic.co/t/watcher-that-counts-the-documents-that-arrive-to-an-index-in-kibana/270609.md?page=3)