Exclusion List for Watcher


I am trying to make an index which could be used as a static list of fields with data that will be used as exclusions in watcher alerts.

At the moment, I am doing that using exclude in the watcher. But for a larger list is it possible to be done using some sort of lookup. That can be used as a whitelist or blacklist in the watcher.

Also, will the use lookup list significant impact on performance. What would be the best way of doing it if any.

Thanks in advance!


How about the Terms Lookup Query? Would that help you?

Hi Alex,

This is useful, but putting it in a watch condition to compare against matching terms from search in the watch is something I am trying to figure out.

Maybe I need to look at it in a different way. Probably matching arrays in the watch search against the lookup index. Any leads if you could share to compare specific keys of one doc to another index's.


You could also use a chain input, then execute a search to look up those filter values, and use that response in the second search for exclusion.

1 Like