# Watcher Webhook stays in "Firing" Status

**URL:** <https://discuss.elastic.co/t/watcher-webhook-stays-in-firing-status/179965>\
**Category:** Kibana\
**Created:** [May 7, 2019, 12:07pm UTC](https://discuss.elastic.co/t/watcher-webhook-stays-in-firing-status/179965 "2019-05-07T12:07:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jasonespo](https://avatars.discourse-cdn.com/v4/letter/j/898d66/32.png) [@Jasonespo](https://discuss.elastic.co/u/Jasonespo)\
**Post date:** [May 7, 2019, 12:07pm UTC](https://discuss.elastic.co/t/watcher-webhook-stays-in-firing-status/179965/1 "2019-05-07T12:07:56Z")

</div>

My Webhook action for a watcher I have stays in Firing state and does not trigger, however when I manually execute the watcher it fires successfully.

The watchers aim is to trigger every time the field "host" exists within the past 5minutes, triggering every 5minutes.

Below shows the issue:

![image](https://us1.discourse-cdn.com/elastic/original/3X/7/f/7f5c5e02119aaf709213a249257a9e432c97416b.png)

Below is the shown "OK" status after a manual execution:

![image](https://us1.discourse-cdn.com/elastic/original/3X/3/b/3b45b86a530735b91a9ca8de41a917602f5c93ee.png)

Below is the result from executing the watch manually:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/4/14dbb028cb1e282e4817cfe2d8565d2ad9ce4de9.png)

Below is the watcher config:

```
 {
  "trigger": {
    "schedule": {
      "interval": "5m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "index*"
        ],
        "types": [],
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "filter": [
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-{{ctx.metadata.window_period}}"
                    }
                  }
                },
                {
                  "exists": {
                    "field": "host"
                  }
                }
              ]
            }
          },
          "aggs": {
            "host": {
              "terms": {
                "field": "host"
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "script": {
      "source": """
        def offenders = [];    
        for (def host: ctx.payload.aggregations.host.buckets) {
            if (host.doc_count >= 0 ) {  
             offenders.add([        
            'host': host.key,        
            'execution_time' : ctx.trigger.triggered_time
      ]);       
            }
       }
      ctx.payload.offenders = offenders;
      return offenders.size() > 0;
""",
      "lang": "painless"
    }
  },
  "actions": {
    "web_hook": {
      "webhook": {
        "scheme": "https",
        "host": "test.com",
        "port": 443,
        "method": "post",
        "path": "/private,
        "params": {},
        "headers": {
          "x-api-key": "xxxxx",
          "Content-Type": "application/json"
        },
        "body": "{{#toJson}}ctx.payload.offenders{{/toJson}}"
      }
    },
    "my-logging-action": {
      "logging": {
        "level": "info",
        "text": "There are {{ctx.payload.hits.total}} documents - {{ctx.payload.hits.hit}}"
      }
    }
  },
  "metadata": {
    "window_period": "5m"
  },
  "throttle_period_in_millis": 120000
}
```

---

<div class="post-metadata">

**Author:** ![markov00](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/markov00/32/33316_2.png) [@markov00](https://discuss.elastic.co/u/markov00)\
**Post date:** [May 24, 2019, 1:33pm UTC](https://discuss.elastic.co/t/watcher-webhook-stays-in-firing-status/179965/2 "2019-05-24T13:33:32Z")

</div>

Hey @Jasonespo unfortunately we are aware of that issue, you can follow the updates on this GH issue: [https://github.com/elastic/kibana/issues/27758](https://github.com/elastic/kibana/issues/27758)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 21, 2019, 1:33pm UTC](https://discuss.elastic.co/t/watcher-webhook-stays-in-firing-status/179965/3 "2019-06-21T13:33:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.