# Watcher works in simulation, but not live **URL:** \ **Category:** Kibana\ **Tags:** painless\ **Created:** [February 1, 2022, 8:55pm UTC](https://discuss.elastic.co/t/watcher-works-in-simulation-but-not-live/296000 "2022-02-01T20:55:49Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Mhughes01](https://avatars.discourse-cdn.com/v4/letter/m/b77776/32.png) [@Mhughes01](https://discuss.elastic.co/u/Mhughes01)\ **Post date:** [February 1, 2022, 8:55pm UTC](https://discuss.elastic.co/t/watcher-works-in-simulation-but-not-live/296000/1 "2022-02-01T20:55:49Z")
Hi Everyone, I'm somewhat new to Kibana and this is my first watcher. It's pretty simple, it looks for a hit on the previous day and if it finds one, it sends an email. When I simulate it, by setting the gte to -2d (there were 4 hits two days ago, but none yesterday), it logs true and sends the email. However, it didn't do that when it ran live yesterday looking at the day before. Also the log text didn't print the number of hits. Here is the code (I removed my email address), and the simulated response: ```auto { "trigger": { "schedule": { "daily": { "at": [ "5:00" ] } } }, "input": { "search": { "request": { "search_type": "query_then_fetch", "indices": [ "mybusiness_user_lock*" ], "rest_total_hits_as_int": true, "body": { "size": 0, "query": { "bool": { "filter": { "range": { "ts_inserted_dt": { "gte": "{{ctx.trigger.scheduled_time}}||-2d", "lte": "{{ctx.trigger.scheduled_time}}", "format": "strict_date_optional_time||epoch_millis" } } } } } } } } }, "condition": { "script": { "source": "if (ctx.payload.hits.total > params.threshold) { return true; } return false;", "lang": "painless", "params": { "threshold": 0 } } }, "actions": { "my-logging-action": { "logging": { "level": "info", "text": "There are {{ctx.payload.hits.total}} documents in your index. Threshold is 0." } }, "send_email": { "email": { "profile": "standard", "to": [ "michelle.hughes@....com" ], "subject": "Daily MyBusiness Lock Error Notification!", "body": { "text": """ There is a new user lock error, please investigate. (https://myurl) """ } } } }, "transform": { "script": { "source": "HashMap result = new HashMap(); result.result = ctx.payload.hits.total; return result;", "lang": "painless", "params": { "threshold": 0 } } } } ``` Simulation Output: ```auto { "watch_id": "_inlined_", "node": "flzqM9O9SyyNZnhBWPeaMA", "state": "executed", "user": "elastic", "status": { "state": { "active": true, "timestamp": "2022-02-01T20:53:24.130Z" }, "last_checked": "2022-02-01T20:53:24.131Z", "last_met_condition": "2022-02-01T20:53:24.131Z", "actions": { "my-logging-action": { "ack": { "timestamp": "2022-02-01T20:53:24.131Z", "state": "ackable" }, "last_execution": { "timestamp": "2022-02-01T20:53:24.131Z", "successful": true }, "last_successful_execution": { "timestamp": "2022-02-01T20:53:24.131Z", "successful": true } }, "send_email": { "ack": { "timestamp": "2022-02-01T20:53:24.131Z", "state": "ackable" }, "last_execution": { "timestamp": "2022-02-01T20:53:24.131Z", "successful": true }, "last_successful_execution": { "timestamp": "2022-02-01T20:53:24.131Z", "successful": true } } }, "execution_state": "executed", "version": -1 }, "trigger_event": { "type": "manual", "triggered_time": "2022-02-01T20:53:24.131Z", "manual": { "schedule": { "scheduled_time": "2022-02-01T20:53:24.131Z" } } }, "input": { "search": { "request": { "search_type": "query_then_fetch", "indices": [ "mybusiness_user_lock*" ], "rest_total_hits_as_int": true, "body": { "size": 0, "query": { "bool": { "filter": { "range": { "ts_inserted_dt": { "gte": "{{ctx.trigger.scheduled_time}}||-2d", "lte": "{{ctx.trigger.scheduled_time}}", "format": "strict_date_optional_time||epoch_millis" } } } } } } } } }, "condition": { "script": { "source": "if (ctx.payload.hits.total > params.threshold) { return true; } return false;", "lang": "painless", "params": { "threshold": 0 } } }, "metadata": { "name": "MyBusiness-User-Lock-Error", "xpack": { "type": "json" } }, "result": { "execution_time": "2022-02-01T20:53:24.131Z", "execution_duration": 1187, "input": { "type": "search", "status": "success", "payload": { "_shards": { "total": 1, "failed": 0, "successful": 1, "skipped": 0 }, "hits": { "hits": [], "total": 4, "max_score": null }, "took": 1, "timed_out": false }, "search": { "request": { "search_type": "query_then_fetch", "indices": [ "mybusiness_user_lock*" ], "rest_total_hits_as_int": true, "body": { "size": 0, "query": { "bool": { "filter": { "range": { "ts_inserted_dt": { "gte": "2022-02-01T20:53:24.131088176Z||-2d", "lte": "2022-02-01T20:53:24.131088176Z", "format": "strict_date_optional_time||epoch_millis" } } } } } } } } }, "condition": { "type": "script", "status": "success", "met": true }, "transform": { "type": "script", "status": "success", "payload": { "result": 4 } }, "actions": [ { "id": "my-logging-action", "type": "logging", "status": "success", "logging": { "logged_text": "There are documents in your index. Threshold is 0." } }, { "id": "send_email", "type": "email", "status": "success", "email": { "account": "gmail_account", "message": { "id": "send_email __inlined__ 441efc96-15e8-4108-b3f6-dc504e82604a-2022-02-01T20:53:24.131102179Z_11", "sent_date": "2022-02-01T20:53:24.133728163Z", "to": [ "michelle.hughes@....com" ], "subject": "Daily MyBusiness Lock Error Notification!", "body": { "text": "\n There is a new user lock error, please investigate.\n (https://myurl)\n " } } } } ] }, "messages": [] } ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 1, 2022, 8:56pm UTC](https://discuss.elastic.co/t/watcher-works-in-simulation-but-not-live/296000/2 "2022-03-01T20:56:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.