# Watcher's State - Error!

**URL:** https://discuss.elastic.co/t/watchers-state-error/119132
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [February 8, 2018, 10:20pm UTC](https://discuss.elastic.co/t/watchers-state-error/119132 "2018-02-08T22:20:51Z")
**Posts on this page:** 13
**Page:** 1

<div class="post-metadata">

### Author: ![alexus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alexus/32/12696_2.png) [@alexus](https://discuss.elastic.co/u/alexus)
#### Post date: [February 8, 2018, 10:20pm UTC](https://discuss.elastic.co/t/watchers-state-error/119132/1 "2018-02-08T22:20:51Z")

</div>

I just noticed that several of X-Pack Monitoring watcher's state is:

> Error!

w/ comment

> Execution Failing

Please advise.

---

<div class="post-metadata">

### Author: ![cjcenizal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cjcenizal/32/11216_2.png) [@cjcenizal](https://discuss.elastic.co/u/cjcenizal)
#### Post date: [February 9, 2018, 9:17pm UTC](https://discuss.elastic.co/t/watchers-state-error/119132/2 "2018-02-09T21:17:37Z")

</div>

Hey Alexus, can you tell me what the name of the failing watch is? Thanks.

CJ

---

<div class="post-metadata">

### Author: ![alexus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alexus/32/12696_2.png) [@alexus](https://discuss.elastic.co/u/alexus)
#### Post date: [February 9, 2018, 9:29pm UTC](https://discuss.elastic.co/t/watchers-state-error/119132/3 "2018-02-09T21:29:49Z")

</div>

Error:

- X-Pack Monitoring: Cluster Status
- X-Pack Monitoring: Nodes Changed
- X-Pack Monitoring: Kibana Version Mismatch
- X-Pack Monitoring: Logstash Version Mismatch

OK:

- X-Pack Monitoring: Elasticsearch Version Mismatch
- X-Pack Monitoring: License Expiration

* * *

I also created several other "watch", one executes without any issues and rest shows blank in "Last Triggered"

---

<div class="post-metadata">

### Author: ![cjcenizal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cjcenizal/32/11216_2.png) [@cjcenizal](https://discuss.elastic.co/u/cjcenizal)
#### Post date: [February 9, 2018, 10:04pm UTC](https://discuss.elastic.co/t/watchers-state-error/119132/4 "2018-02-09T22:04:53Z")

</div>

OK, so one of the watches which is failing is the `elasticsearch_cluster_status` watch. Could you execute this watch and share the output with me? You can run the watch like this:

```auto
POST /_xpack/watcher/watch/${cluster_uuid}_elasticsearch_cluster_status/_execute

```

The UUID should be visible in the Watches table, or you can get it from the `_id` value of the response from `GET /.watches/_search?_source=_id`.

Thanks,  
CJ

---

<div class="post-metadata">

### Author: ![alexus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alexus/32/12696_2.png) [@alexus](https://discuss.elastic.co/u/alexus)
#### Post date: [February 9, 2018, 10:38pm UTC](https://discuss.elastic.co/t/watchers-state-error/119132/5 "2018-02-09T22:38:27Z")

</div>

@cjcenizal pretty sure I wouldn't be able to paste my answer here, so I [pastebin](https://pastebin.com/EpbSxQV7) it instead)

---

<div class="post-metadata">

### Author: ![cjcenizal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cjcenizal/32/11216_2.png) [@cjcenizal](https://discuss.elastic.co/u/cjcenizal)
#### Post date: [February 9, 2018, 10:42pm UTC](https://discuss.elastic.co/t/watchers-state-error/119132/6 "2018-02-09T22:42:58Z")

</div>

Well, that's odd. That looks like a healthy watch. Could you share a screenshot of your watches table, showing the failed watches?

---

<div class="post-metadata">

### Author: ![alexus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alexus/32/12696_2.png) [@alexus](https://discuss.elastic.co/u/alexus)
#### Post date: [February 10, 2018, 4:09am UTC](https://discuss.elastic.co/t/watchers-state-error/119132/7 "2018-02-10T04:09:24Z")

</div>

![42%20PM](https://us1.discourse-cdn.com/elastic/original/3X/3/0/30dade939f74174d28927abc280baffe813eb90b.png)

---

<div class="post-metadata">

### Author: ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [February 12, 2018, 8:58am UTC](https://discuss.elastic.co/t/watchers-state-error/119132/8 "2018-02-12T08:58:57Z")

</div>

some moon shot from the current information: do you have an email account configured in your alerting setup, that maybe is not set up properly?

--Alex

---

<div class="post-metadata">

### Author: ![alexus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alexus/32/12696_2.png) [@alexus](https://discuss.elastic.co/u/alexus)
#### Post date: [February 13, 2018, 4:04am UTC](https://discuss.elastic.co/t/watchers-state-error/119132/9 "2018-02-13T04:04:29Z")

</div>

for moon shot... it's like bullseyes)

my setup is testing environment, I'll try to configure email account and see if that resolves my issue...

---

<div class="post-metadata">

### Author: ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [February 13, 2018, 9:46am UTC](https://discuss.elastic.co/t/watchers-state-error/119132/10 "2018-02-13T09:46:57Z")

</div>

would it be also possible to share the output of the watcher history for one of your watches where the run was failed?

Thanks a lot!

---

<div class="post-metadata">

### Author: ![alexus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alexus/32/12696_2.png) [@alexus](https://discuss.elastic.co/u/alexus)
#### Post date: [February 13, 2018, 5:50pm UTC](https://discuss.elastic.co/t/watchers-state-error/119132/11 "2018-02-13T17:50:53Z")

</div>

@spinscale, can you provide curl command?

---

<div class="post-metadata">

### Author: ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [February 14, 2018, 7:36am UTC](https://discuss.elastic.co/t/watchers-state-error/119132/12 "2018-02-14T07:36:55Z")

</div>

If you only have the monitoring watches installed, you can just run this

```auto
GET .watcher-history-*/_search
{
  "sort": [
    {
      "result.execution_time": {
        "order": "desc"
      }
    }
  ]
}

```

might be too much output to put here, so please put it into a gist/pastebin or something.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 14, 2018, 7:37am UTC](https://discuss.elastic.co/t/watchers-state-error/119132/13 "2018-03-14T07:37:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
