DateMath in Watcher Definition for Index name

Elastic Stack Elasticsearch
1

I'm trying to set up a watcher that searches a filebeat index with a date in the name.

The watcher itself is executing, but not firing, and I'm concerned that it's because the index isn't being resolved correctly.

The indices name is defined as

<filebeat-*-{now/d}>

When retrieving the watcher via the GET /_xpack/watcher/watch/name/ or POST /_xpack/watcher/watch/name/_execute endpoint, the index name isn't translated, but still appears as <filebeat-*-{now/d}>.

Is there something wrong with this set up?

2

This is ok and expected. it will only be translated once the search is executed on the elasticsearch side when the watch executes.

3

Thanks, that at least means what I'm seeing isn't wrong. And it does seem to be working now that I've widened some search parameters.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.