Hello team,
I need to create watcher to check for no data in all the indices. I have total 100+ indices.
- I am using below script. in indices, i am putting * is this work?
- I need all index name in body which have 0 records from last 15 min
{
"trigger": {
"schedule": {
"interval": "240m"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"*"
],
"rest_total_hits_as_int": true,
"body": {
"query": {
"bool": {
"must": [],
"filter": [
{
"match_all": {}
},
{
"range": {
"@timestamp": {
"gte": "now-15m",
"lte": "now",
"format": "strict_date_optional_time"
}
}
}
],
"should": [],
"must_not": []
}
}
}
}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"lte": 0
}
}
},
"actions": {
"send_email": {
"email": {
"profile": "standard",
"from": "mj@gmail.com",
"to": [
"abc@gmail.com"
],
"subject": "Test Email :: There is no log data from last 15 min in below indices",
"body": {
"html": """<html>
<body>
<strong>There is no log data from last 15 min in below indices </strong>
// need to display list of indices here.
<br />
<br />
</body>
</html>
"""
}
}
}
}
}