# Watcher to check if a cluster node is online **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-alerting\ **Created:** [August 8, 2018, 9:58am UTC](https://discuss.elastic.co/t/watcher-to-check-if-a-cluster-node-is-online/143474 "2018-08-08T09:58:21Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![sahil\_sawhney](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sahil_sawhney/32/88932_2.png) [@sahil\_sawhney](https://discuss.elastic.co/u/sahil_sawhney)\ **Post date:** [August 8, 2018, 9:58am UTC](https://discuss.elastic.co/t/watcher-to-check-if-a-cluster-node-is-online/143474/1 "2018-08-08T09:58:21Z")
The Kibana UI for elasticsearch cluster renders as follows ![es_status](https://us1.discourse-cdn.com/elastic/original/3X/7/9/79292980d7345b1053f5b86caa92c999c464d64c.png) here i need to apply watcher on the node status so that whenever a node is offline i get a email trigger. Inputs are highly appriciated ---
**Author:** ![sahil\_sawhney](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sahil_sawhney/32/88932_2.png) [@sahil\_sawhney](https://discuss.elastic.co/u/sahil_sawhney)\ **Post date:** [August 9, 2018, 9:45am UTC](https://discuss.elastic.co/t/watcher-to-check-if-a-cluster-node-is-online/143474/2 "2018-08-09T09:45:05Z")
Basically i want to trigger an alert as soon as a cluster node goes down. The monitoring data produced for es nodes do not tell about the status of node, if it is healthy or not. Need a way to determine if a node is healthy and set a watcher accordingly. ---
**Author:** ![cjcenizal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cjcenizal/32/11216_2.png) [@cjcenizal](https://discuss.elastic.co/u/cjcenizal)\ **Post date:** [August 13, 2018, 4:54pm UTC](https://discuss.elastic.co/t/watcher-to-check-if-a-cluster-node-is-online/143474/3 "2018-08-13T16:54:52Z")
Hi there, One possible solution could check to see if the number of nodes is less than you expect. If you have a cluster of 3 nodes then you could set up a watch like this: ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/6/a65fcebc01fe8d846b30904a87408b17cd9fa702.png) Will this work? Or do you need to know when a specific node has become unavailable? Thanks, CJ ---
**Author:** ![sahil\_sawhney](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sahil_sawhney/32/88932_2.png) [@sahil\_sawhney](https://discuss.elastic.co/u/sahil_sawhney)\ **Post date:** [August 14, 2018, 11:57am UTC](https://discuss.elastic.co/t/watcher-to-check-if-a-cluster-node-is-online/143474/4 "2018-08-14T11:57:54Z")
Thanks @cjcenizal This do gives us the number of ES nodes that are down but i dont think this would be telling us the name and ip of the nodes that are down in the email. Any clue how we can achieve that? Regards ---
**Author:** ![cjcenizal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cjcenizal/32/11216_2.png) [@cjcenizal](https://discuss.elastic.co/u/cjcenizal)\ **Post date:** [August 14, 2018, 9:29pm UTC](https://discuss.elastic.co/t/watcher-to-check-if-a-cluster-node-is-online/143474/5 "2018-08-14T21:29:07Z")
Unfortunately, I don't think there's any way to get more granularity than this in your watch. ---
**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Post date:** [August 17, 2018, 8:57am UTC](https://discuss.elastic.co/t/watcher-to-check-if-a-cluster-node-is-online/143474/6 "2018-08-17T08:57:19Z")
If you are willing to not use the watcher UI (as that one is based on aggregates as you can see the `count()` function above), and have a term aggregation on hostnames from the monitoring data, you could compare two time windows against each other and find out which hosts have been there 5-10 minutes ago vs those which have been there 0-5 minutes ago. If those are different, trigger an alert. This requires you to write some thorough queries manually first, before writing a watch. basically querying the monitoring data from the last ten minutes, then filter into two buckets (now-5m and 5-10m ago), and then aggregate on all the hostnames. It's not a task you do super quick, if you are not familiar with the query DSL, but you can try it out we can help over here. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 14, 2018, 8:57am UTC](https://discuss.elastic.co/t/watcher-to-check-if-a-cluster-node-is-online/143474/7 "2018-09-14T08:57:24Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.