Hello,
I'm looking to add a new condition to my working watcher. Currently, it alerts when the index doesn't received logs in the last 10 minutes (see below). The functionality I'm trying to add is to alert when the index have received logs in the last 30 minutes, but not in the last 10 minutes. Please advise what I need to add to this working watcher. FYI, I looked into this, but it doesn't work as expected, probably cause it was build for version 7.x and I use 8.6
PUT _watcher/watch/my-watcher
{
"trigger": {
"schedule": {
"interval": "5m"
}
},
"input": {
"search": {
"request": {
"body": {
"size": 0,
"query": {
"bool": {
"filter": {
"range": {
"timestamp": {
"gte": "{{ctx.trigger.scheduled_time}}||-10m",
"lte": "{{ctx.trigger.scheduled_time}}",
"format": "strict_date_optional_time||epoch_millis"
}
}
}
}
}
},
"indices": [
"my_index"
]
}
}
},
"condition": {
"script": {
"source": "if (ctx.payload.hits.total <= params.threshold) { return true; } return false;",
"params": {
"threshold": 0
}
}
},
"transform": {
"script": {
"source": "HashMap result = new HashMap(); result.result = ctx.payload.hits.total; return result;",
"params": {
"threshold": 0
}
}
},
"actions": {
"logging_1": {
"logging": {
"text": "Watch [{{ctx.metadata.name}}] has exceeded the threshold"
}
}
}
}