# What should i do to trigger a watch only when condition matches to a certain requirement **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-alerting\ **Created:** [May 6, 2018, 3:13pm UTC](https://discuss.elastic.co/t/what-should-i-do-to-trigger-a-watch-only-when-condition-matches-to-a-certain-requirement/130750 "2018-05-06T15:13:39Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![addanuj](https://avatars.discourse-cdn.com/v4/letter/a/d2c977/32.png) [@addanuj](https://discuss.elastic.co/u/addanuj)\ **Post date:** [May 6, 2018, 3:13pm UTC](https://discuss.elastic.co/t/what-should-i-do-to-trigger-a-watch-only-when-condition-matches-to-a-certain-requirement/130750/1 "2018-05-06T15:13:40Z")
Hi I am trying to create a watch which should alert our Team only when a certain condition matches, For example: "whenever a Failed Login Attempt Detected" RightNow it is sending me an email after each 1 hour with same ctx.paylod.hits.total as no failed login is made and /var/log/secure file has no updates, same time my index which is carrying out /var/log/secure logs is the same as I stopped trying failed attempts, but watcher still sending because it has a scheduled trigger of 1 hr. how can I make it trigger only when a certain condition matches like whenever someone tries to do login and gets failed then only it should send me an email, or whenever index gets updated then only I should get an update by email { "trigger": { "schedule": { "interval": "1h" } }, "input": { "search": { "request": { "body": { "size": 0, "query": { "match\_phrase" : { "message" : "Failed password for invalid user" } ``` } }, "indices": [ "*" ] } } ``` }, "condition": { "compare": { "ctx.payload.hits.total": { "gte": 1 } } }, "actions" : { "gmail\_account": { "email": { "profile": "standard", "to": [ "testemail@gmail.com" ], "subject": "ELK Alert: Failed logging attempts Detected !", "body": { "text" : "WARNING: There are {{ctx.payload.hits.total}} Failed logging attempts Detected in last 1 Hour. " } } }, "my-logging-action": { "logging": { "text" : "WARNING: There are {{ctx.payload.hits.total}} Failed logging attempts Detected in last 1 Hour. " } } } } ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [May 6, 2018, 3:40pm UTC](https://discuss.elastic.co/t/what-should-i-do-to-trigger-a-watch-only-when-condition-matches-to-a-certain-requirement/130750/2 "2018-05-06T15:40:44Z")
The watch will trigger once every hour, but you do not seem to have a range condition in your query to only search logs that came in the last X hours. The query therefore looks at ALL data, which might be why you are seeing an email being generated every time. ---
**Author:** ![addanuj](https://avatars.discourse-cdn.com/v4/letter/a/d2c977/32.png) [@addanuj](https://discuss.elastic.co/u/addanuj)\ **Post date:** [May 6, 2018, 3:47pm UTC](https://discuss.elastic.co/t/what-should-i-do-to-trigger-a-watch-only-when-condition-matches-to-a-certain-requirement/130750/3 "2018-05-06T15:47:58Z")
Hi Christian, Thanks for your help... Please explain or give me an example. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [May 6, 2018, 4:42pm UTC](https://discuss.elastic.co/t/what-should-i-do-to-trigger-a-watch-only-when-condition-matches-to-a-certain-requirement/130750/4 "2018-05-06T16:42:47Z")
Add a [range query](https://www.elastic.co/guide/en/elasticsearch/reference/6.2/query-dsl-range-query.html#ranges-on-dates) component to your query that filters out results older than when the watch last ran (you may want to add a bit extra margin). ---
**Author:** ![addanuj](https://avatars.discourse-cdn.com/v4/letter/a/d2c977/32.png) [@addanuj](https://discuss.elastic.co/u/addanuj)\ **Post date:** [May 6, 2018, 4:49pm UTC](https://discuss.elastic.co/t/what-should-i-do-to-trigger-a-watch-only-when-condition-matches-to-a-certain-requirement/130750/5 "2018-05-06T16:49:12Z")
i am not able to understand you. can you write a sample for my query, i think i need to write compare condition when current count of "ctx.payload.hits.total" is gte than Last "ctx.payload.hits.total" but dont know how to compare two "ctx.payload.hits.total" current one and last one. ☹ ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [May 7, 2018, 6:01am UTC](https://discuss.elastic.co/t/what-should-i-do-to-trigger-a-watch-only-when-condition-matches-to-a-certain-requirement/130750/6 "2018-05-07T06:01:40Z")
You need to change you query to something like this: ```auto "query": { "bool": { "must": { "match_phrase" : { "message" : "Failed password for invalid user" } }, "filter": { "range" : { "@timestamp" : { "gte" : "now-1h" } } } } } ``` This will prevent you from looking at ALL documents in the index every time, as only the documents with a `@timestamp` within the last hour are considered. ---
**Author:** ![addanuj](https://avatars.discourse-cdn.com/v4/letter/a/d2c977/32.png) [@addanuj](https://discuss.elastic.co/u/addanuj)\ **Post date:** [May 9, 2018, 7:23pm UTC](https://discuss.elastic.co/t/what-should-i-do-to-trigger-a-watch-only-when-condition-matches-to-a-certain-requirement/130750/7 "2018-05-09T19:23:14Z")
Thanks Christian, it works !!!! , Thank you soo much... is this also possible to create instant alerting system using watches? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 6, 2018, 7:23pm UTC](https://discuss.elastic.co/t/what-should-i-do-to-trigger-a-watch-only-when-condition-matches-to-a-certain-requirement/130750/8 "2018-06-06T19:23:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.