# Watcher working once, but not more

**URL:** <https://discuss.elastic.co/t/watcher-working-once-but-not-more/206341>\
**Category:** Kibana\
**Created:** [November 4, 2019, 7:34am UTC](https://discuss.elastic.co/t/watcher-working-once-but-not-more/206341 "2019-11-04T07:34:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mangeloco](https://avatars.discourse-cdn.com/v4/letter/m/bbe5ce/32.png) [@mangeloco](https://discuss.elastic.co/u/mangeloco)\
**Post date:** [November 4, 2019, 7:34am UTC](https://discuss.elastic.co/t/watcher-working-once-but-not-more/206341/1 "2019-11-04T07:34:56Z")

</div>

Hello everyone!  
I set up a watcher to alert on me Slack if any failed login attempt was made on any of my servers every 20 seconds for the past 20 seconds, as follows

{  
"trigger": {  
"schedule": {  
"interval": "20s"  
}  
},  
"input": {  
"search": {  
"request": {  
"search\_type": "query\_then\_fetch",  
"indices": [  
"auditbeat-\*"  
],  
"rest\_total\_hits\_as\_int": true,  
"body": {  
"query": {  
"bool": {  
"filter": [  
{  
"range": {  
"@timestamp": {  
"gte": "now-20s",  
"lte": "now"  
}  
}  
}  
],  
"must": {  
"match": [  
{  
"message": "Failed login by"  
}  
]  
}  
}  
}  
}  
}  
}  
},  
"condition": {  
"compare": {  
"ctx.payload.hits.total": {  
"gt": 0  
}  
}  
},  
"actions": {  
"notify-slack": {  
"slack": {  
"message": {  
"text": "!!intruder alert!! {{#toJson}}ctx.payload{{/toJson}} "  
}  
}  
}  
}  
}

The alert would trigger perfectly on the first failed attempt, but would become extremely unreliable afterwards, to the point of not triggering anymore.  
Could anyone please help me out with the above?

Also, ctx.payload will dump all of the query up my face, and i couldn't find anywhere any document saying to extract certain field of it.

i.e:  
What I am getting:

!!intruder alert!! {"\_shards":{"total":1,"failed":0,"successful":1,"skipped":0},"hits":{"hits":[{"\_index":"auditbeat-7.4.0-2019.10.31-000001","\_type":"\_doc","\_source":{"process":{"pid":6725},"agent":{"hostname":"_ **","name":"** _","id":"_ **","type":"auditbeat","ephemeral\_id":"** _","version":"7.4.0"},"@timestamp":"2019-11-03T14:10:18.000Z","ecs":{"version":"1.1.0"},"service":{"type":"system"},"host":{"hostname":"_**","os":{"kernel":"4.18.0-80.7.1.el8\_0.x86\_64","codename":"Core","name":"CentOS Linux","family":"redhat","version":"8 (Core)","platform":"centos"},"containerized":false,"name":"**_","id":"d9d5dba3f82c42d1b9a983b4dd1ae701","architecture":"x86\_64"},"source":{"ip":"\*\*\*\*\*\*\*"},"event":{"kind":"event","origin":"/var/log/btmp","module":"system","action":"user\_login","category":"authentication","type":"authentication\_failure","dataset":"login","outcome":"failure"},"message":"Failed login by user root (UID: 0) on ssh:notty (PID: 6725) from \*\*\*\*\*\*\* (IP: \*\*\*\*\*\*\*)","user":{"name":"root","id":0,"terminal":"ssh:notty"}},"\_id":"8UuZMW4BOf42KXSOjKgf","\_score":21.54823}],"total":1,"max\_score":21.54823},"took":2,"timed\_out":false}

What I want to get :

!!intruder alert!! {{:message:}} on {{:hostname:}}

---

<div class="post-metadata">

**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\
**Post date:** [November 18, 2019, 5:00pm UTC](https://discuss.elastic.co/t/watcher-working-once-but-not-more/206341/2 "2019-11-18T17:00:00Z")

</div>

Hi,  
you can follow this thread on how to customize the results: [How to create a watch that email specific field from input index?](https://discuss.elastic.co/t/how-to-create-a-watch-that-email-specific-field-from-input-index/56947/15)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 16, 2019, 5:13pm UTC](https://discuss.elastic.co/t/watcher-working-once-but-not-more/206341/3 "2019-12-16T17:13:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.