# ElasticSearch Watcher

**URL:** <https://forum.alumio.com/t/elasticsearch-watcher/201>\
**Category:** Best Practices\
**Tags:** best-practice\
**Created:** [October 10, 2022, 12:49pm UTC](https://forum.alumio.com/t/elasticsearch-watcher/201 "2022-10-10T12:49:42Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alumio\_Bot](https://forum.alumio.com/user_avatar/forum.alumio.com/alumio_bot/32/1824_2.png) [@Alumio\_Bot](https://forum.alumio.com/u/Alumio_Bot)\
**Post date:** [October 10, 2022, 12:49pm UTC](https://forum.alumio.com/t/elasticsearch-watcher/201/1 "2022-10-10T12:49:42Z")

</div>

### **Table Of Contents**

- purpose
- How to use

### **Purpose**

This guide explains how you can trigger action for any error caused by the executing of an incoming or route configuration.

### **How to use**

1. Replace CUSTOMER\_INDICE\_NAME with the actual name of the indices, e.g. Alumio-uat.
2. Set up the interval you want to work the script with. Default is 5 minutes.  
a. You have to change this on line 4 and line 28.
3. Configure the desired action.  
a. It.could be a message to Teams;  
b. It could be a message to Slack;  
c. An email;  
d. Anything with a communication protocol.
4. Go to the correct Elastic/Kibana instance and add the script as an ‘advanced’ watcher.  
a. Open Kibana.  
b. Navigate to _Management → Stack Management._  
c. Using the on-page navigation navigate to _Alerts and Insights → Watcher._  
d. Press _Create_ and then _Create advanced watcher._

```auto
{
  "trigger": {
    "schedule": {
      "interval": "5m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "CUSTOMER_INDICE_NAME-filebeat-*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 500,
          "query": {
            "bool": {
              "must": [
                {
                  "match": {
                    "@fields.level": "400"
                  }
                },
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-5m",
                      "lt": "now"
                    }
                  }
                },
                {
                  "exists": {
                    "field": "@fields.scope.incoming_id"
                  }
                }
              ],
              "must_not": [
                {
                  "term": {
                    "@message": "Exception in incoming process"
                  }
                }
              ]
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gte": 1
      }
    }
  },
  "actions": {
    "log_hits": {
      "foreach": "ctx.payload.hits.hits",
      "max_iterations": 500,
      "logging": {
        "level": "info",
        "text": "ERROR | {{ctx.payload._source.@message}} | {{ctx.payload._source.@fields.scope.incoming_id}} | {{ctx.payload._source.@fields.scope.route_id}}"
      }
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![o.plokha](https://forum.alumio.com/user_avatar/forum.alumio.com/o.plokha/32/337_2.png) [@o.plokha](https://forum.alumio.com/u/o.plokha)\
**Post date:** [January 21, 2026, 10:15am UTC](https://forum.alumio.com/t/elasticsearch-watcher/201/2 "2026-01-21T10:15:07Z")

</div>