# Watcher when a server goes down and a followup if it's been down for 24 hours?

**URL:** https://discuss.elastic.co/t/watcher-when-a-server-goes-down-and-a-followup-if-its-been-down-for-24-hours/218842
**Category:** Kibana
**Tags:** elastic-stack-alerting
**Created:** [February 11, 2020, 6:41pm UTC](https://discuss.elastic.co/t/watcher-when-a-server-goes-down-and-a-followup-if-its-been-down-for-24-hours/218842 "2020-02-11T18:41:24Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![devbot](https://avatars.discourse-cdn.com/v4/letter/d/9de0a6/32.png) [@devbot](https://discuss.elastic.co/u/devbot)
#### Post date: [February 11, 2020, 6:41pm UTC](https://discuss.elastic.co/t/watcher-when-a-server-goes-down-and-a-followup-if-its-been-down-for-24-hours/218842/1 "2020-02-11T18:41:24Z")

</div>

Hello,

I have a number of servers being pinged by heartbeat. What I'm trying to figure out how to do is:

- "Watcher 1" run every minute - When a server has been consistently down for a minute (no monitor.status = up for any documents for one particular address in heartbeat for the past 60 seconds of documents), send an email notification, then trigger a "watcher" to evaluate again every 24 hours.  
- "Watcher 2" - At the 24 hour mark, if the server has still been consistently down (no monitor.status = up for any document for that one address pinged in any of the heartbeat documents returned for that server for the past 24 hours), trigger another email.  
- During this "wait 24 hour" period, suspend "Watcher 1" running every minute on the server

Is something like this doable with the watcher functionality? I've seen workflows posted before about a simple downtime notification, but not sure if the rest of this can be performed.

---

<div class="post-metadata">

### Author: ![joelgriffith](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joelgriffith/32/53738_2.png) [@joelgriffith](https://discuss.elastic.co/u/joelgriffith)
#### Post date: [March 5, 2020, 10:31pm UTC](https://discuss.elastic.co/t/watcher-when-a-server-goes-down-and-a-followup-if-its-been-down-for-24-hours/218842/2 "2020-03-05T22:31:29Z")

</div>

@devbot You definitely can do something like this with Watcher. Unfortunately I don't have a working example to share directly with you, [but there's a good corpus of information here](https://www.elastic.co/guide/en/kibana/current/watcher-ui.html#watcher-create-advanced-watch) if you haven't seen it already.

You'll also need to [configure email settings](https://www.elastic.co/guide/en/elasticsearch/reference/current/notification-settings.html#email-notification-settings) in Watcher to do so.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 2, 2020, 10:31pm UTC](https://discuss.elastic.co/t/watcher-when-a-server-goes-down-and-a-followup-if-its-been-down-for-24-hours/218842/3 "2020-04-02T22:31:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
