Path parameters
- id
string Required The identifier for the watch.
Query parameters
- active
boolean The initial state of the watch. The default value is
true, which means the watch is active by default. - if_primary_term
number only update the watch if the last operation that has changed the watch has the specified primary term
- if_seq_no
number only update the watch if the last operation that has changed the watch has the specified sequence number
- version
number Explicit version number for concurrency control
Body
- actions
object The list of actions that will be run if the condition matches.
- condition
object - input
object - metadata
object - throttle_period
string A duration. Units can be
nanos,micros,ms(milliseconds),s(seconds),m(minutes),h(hours) andd(days). Also accepts "0" without a unit and "-1" to indicate an unspecified value. Time unit for milliseconds
- transform
object - trigger
object
POST /_watcher/watch/{id}
Console
PUT _watcher/watch/my-watch
{
"trigger" : {
"schedule" : { "cron" : "0 0/1 * * * ?" }
},
"input" : {
"search" : {
"request" : {
"indices" : [
"logstash*"
],
"body" : {
"query" : {
"bool" : {
"must" : {
"match": {
"response": 404
}
},
"filter" : {
"range": {
"@timestamp": {
"from": "{{ctx.trigger.scheduled_time}}||-5m",
"to": "{{ctx.trigger.triggered_time}}"
}
}
}
}
}
}
}
}
},
"condition" : {
"compare" : { "ctx.payload.hits.total" : { "gt" : 0 }}
},
"actions" : {
"email_admin" : {
"email" : {
"to" : "[email protected]",
"subject" : "404 recently encountered"
}
}
}
}resp = client.watcher.put_watch(
id="my-watch",
trigger={
"schedule": {
"cron": "0 0/1 * * * ?"
}
},
input={
"search": {
"request": {
"indices": [
"logstash*"
],
"body": {
"query": {
"bool": {
"must": {
"match": {
"response": 404
}
},
"filter": {
"range": {
"@timestamp": {
"from": "{{ctx.trigger.scheduled_time}}||-5m",
"to": "{{ctx.trigger.triggered_time}}"
}
}
}
}
}
}
}
}
},
condition={
"compare": {
"ctx.payload.hits.total": {
"gt": 0
}
}
},
actions={
"email_admin": {
"email": {
"to": "[email protected]",
"subject": "404 recently encountered"
}
}
},
)const response = await client.watcher.putWatch({
id: "my-watch",
trigger: {
schedule: {
cron: "0 0/1 * * * ?",
},
},
input: {
search: {
request: {
indices: ["logstash*"],
body: {
query: {
bool: {
must: {
match: {
response: 404,
},
},
filter: {
range: {
"@timestamp": {
from: "{{ctx.trigger.scheduled_time}}||-5m",
to: "{{ctx.trigger.triggered_time}}",
},
},
},
},
},
},
},
},
},
condition: {
compare: {
"ctx.payload.hits.total": {
gt: 0,
},
},
},
actions: {
email_admin: {
email: {
to: "[email protected]",
subject: "404 recently encountered",
},
},
},
});response = client.watcher.put_watch(
id: "my-watch",
body: {
"trigger": {
"schedule": {
"cron": "0 0/1 * * * ?"
}
},
"input": {
"search": {
"request": {
"indices": [
"logstash*"
],
"body": {
"query": {
"bool": {
"must": {
"match": {
"response": 404
}
},
"filter": {
"range": {
"@timestamp": {
"from": "{{ctx.trigger.scheduled_time}}||-5m",
"to": "{{ctx.trigger.triggered_time}}"
}
}
}
}
}
}
}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gt": 0
}
}
},
"actions": {
"email_admin": {
"email": {
"to": "[email protected]",
"subject": "404 recently encountered"
}
}
}
}
)$resp = $client->watcher()->putWatch([
"id" => "my-watch",
"body" => [
"trigger" => [
"schedule" => [
"cron" => "0 0/1 * * * ?",
],
],
"input" => [
"search" => [
"request" => [
"indices" => array(
"logstash*",
),
"body" => [
"query" => [
"bool" => [
"must" => [
"match" => [
"response" => 404,
],
],
"filter" => [
"range" => [
"@timestamp" => [
"from" => "{{ctx.trigger.scheduled_time}}||-5m",
"to" => "{{ctx.trigger.triggered_time}}",
],
],
],
],
],
],
],
],
],
"condition" => [
"compare" => [
"ctx.payload.hits.total" => [
"gt" => 0,
],
],
],
"actions" => [
"email_admin" => [
"email" => [
"to" => "[email protected]",
"subject" => "404 recently encountered",
],
],
],
],
]);curl -X PUT -H "Authorization: ApiKey $ELASTIC_API_KEY" -H "Content-Type: application/json" -d '{"trigger":{"schedule":{"cron":"0 0/1 * * * ?"}},"input":{"search":{"request":{"indices":["logstash*"],"body":{"query":{"bool":{"must":{"match":{"response":404}},"filter":{"range":{"@timestamp":{"from":"{{ctx.trigger.scheduled_time}}||-5m","to":"{{ctx.trigger.triggered_time}}"}}}}}}}}},"condition":{"compare":{"ctx.payload.hits.total":{"gt":0}}},"actions":{"email_admin":{"email":{"to":"[email protected]","subject":"404 recently encountered"}}}}' "$ELASTICSEARCH_URL/_watcher/watch/my-watch"Request example
Run `PUT _watcher/watch/my-watch` add a watch. The watch schedule triggers every minute. The watch search input looks for any 404 HTTP responses that occurred in the last five minutes. The watch condition checks if any search hits where found. When found, the watch action sends an email to an administrator.
{
"trigger" : {
"schedule" : { "cron" : "0 0/1 * * * ?" }
},
"input" : {
"search" : {
"request" : {
"indices" : [
"logstash*"
],
"body" : {
"query" : {
"bool" : {
"must" : {
"match": {
"response": 404
}
},
"filter" : {
"range": {
"@timestamp": {
"from": "{{ctx.trigger.scheduled_time}}||-5m",
"to": "{{ctx.trigger.triggered_time}}"
}
}
}
}
}
}
}
}
},
"condition" : {
"compare" : { "ctx.payload.hits.total" : { "gt" : 0 }}
},
"actions" : {
"email_admin" : {
"email" : {
"to" : "[email protected]",
"subject" : "404 recently encountered"
}
}
}
}