DateMath in Watcher Definition for Index name

I'm trying to set up a watcher that searches a filebeat index with a date in the name.

The watcher itself is executing, but not firing, and I'm concerned that it's because the index isn't being resolved correctly.

The indices name is defined as

<filebeat-*-{now/d}>

When retrieving the watcher via the GET /_xpack/watcher/watch/name/ or POST /_xpack/watcher/watch/name/_execute endpoint, the index name isn't translated, but still appears as <filebeat-*-{now/d}>.

Is there something wrong with this set up?

This is ok and expected. it will only be translated once the search is executed on the elasticsearch side when the watch executes.

Thanks, that at least means what I'm seeing isn't wrong. And it does seem to be working now that I've widened some search parameters.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.