# \[watchers\] over all documents or top?

**URL:** <https://discuss.elastic.co/t/watchers-over-all-documents-or-top/205815>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [October 30, 2019, 9:34am UTC](https://discuss.elastic.co/t/watchers-over-all-documents-or-top/205815 "2019-10-30T09:34:03Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![real\_legend](https://avatars.discourse-cdn.com/v4/letter/r/977dab/32.png) [@real\_legend](https://discuss.elastic.co/u/real_legend)\
**Post date:** [October 30, 2019, 9:34am UTC](https://discuss.elastic.co/t/watchers-over-all-documents-or-top/205815/1 "2019-10-30T09:34:03Z")

</div>

hi there  
while creating new alarm there is a 'over' field with two values: 1. all documents 2. top  
i want to know what each of them means?

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [October 31, 2019, 12:57pm UTC](https://discuss.elastic.co/t/watchers-over-all-documents-or-top/205815/2 "2019-10-31T12:57:30Z")

</div>

Just to clarify: Can you be more specific what you mean/where you saw this field? Are you talking about the Watcher UI here?

---

<div class="post-metadata">

**Author:** ![real\_legend](https://avatars.discourse-cdn.com/v4/letter/r/977dab/32.png) [@real\_legend](https://discuss.elastic.co/u/real_legend)\
**Post date:** [November 2, 2019, 5:41am UTC](https://discuss.elastic.co/t/watchers-over-all-documents-or-top/205815/3 "2019-11-02T05:41:30Z")

</div>

yes, watcher ui

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [November 4, 2019, 10:04am UTC](https://discuss.elastic.co/t/watchers-over-all-documents-or-top/205815/4 "2019-11-04T10:04:55Z")

</div>

Hey,

so total document count just counts all the hits, where as 'grouped over' means that any of the top5 value counts, that is grouped by some criteria is compared against the threshold.

Imagine you search in ecommerce products, you could either count all the products or group by `category_id` and only if a count over one of the groups would be over the threshold, the action would trigger.

hope this helps.

--Alex

Hope that helps!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 2, 2019, 10:05am UTC](https://discuss.elastic.co/t/watchers-over-all-documents-or-top/205815/5 "2019-12-02T10:05:14Z")

</div>

Closed on December 2, 2019, 10:05am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.