Execution of a watcher when another one has been executed

Elastic Stack Elasticsearch
,
1

hello good, I need help with the trigger of an alert, I want it to run when another alert has been executed, I do not know if you explain to me when I detect that another alert has been executed this is executed. I do not know if this is possible, but I need to know if it can be done, thanks.

this is the alert I need to activate when the other one has been executed...

{
  "trigger": {
    "schedule": {
      "interval": "1h"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "agenteallot*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "filter": [
                {
                  "range": {
                    "@timestamp": {
                      "gte": "{{ctx.trigger.scheduled_time}}||-5m",
                      "lte": "{{ctx.trigger.scheduled_time}}",
                      "format": "strict_date_optional_time||basic_time_no_millis"
                    }
                  }
                },
                {
                  "term": {
                    "monitor.name.keyword": "04-1-CAV30CI1012712-VIVERO-PPAL-384M-99.8"
                  }
                }
              ]
            }
          },
          "aggs": {
            "metricAgg": {
              "max": {
                "field": "summary.down"
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "script": {
      "source": "if (ctx.payload.aggregations.metricAgg.value >= params.threshold) { return false; } return true;",
      "lang": "painless",
      "params": {
        "threshold": 0.8
      }
    }
  },
  "actions": {
    "email_1": {
      "email": {
        "profile": "standard",
        "attach_data": {
          "format": "yaml"
        },
        "to": [
          "victor.vera@megadvantage.com",
          "telecomunicaciones@udistrital.edu.co",
          "juan.jaramillo@megadvantage.com",
          "juancho.jaramillo16@gmail.com",
          "oscar.ninog.pr@etb.com.co",
          "jose.caceresg@etb.com.co",
          "karen.marriagaj.pr@etb.com.co"
        ],
        "subject": "{{ctx.metadata.name}} ",
        "body": {
          "text": """Buen dia, Adjunto registro del reporte.

 鈿狅笍ALERTA NODO!!! El siguiente enlace ha restablecido la conexi贸n. 

 Estado: UP馃煝 

 Nombre del Enlace: 04-1-CAV30CI1012712-VIVERO-PPAL-384M-99.8

 馃暓Hora: {{ctx.payload.time_triggered}}  {{ctx.result.execution_time}}

 脕rea: Networking 
 
馃敂Mensaje Alerta: El enlace ha vuelto a responder. Responder correo a telecomunicaciones@udistrital.edu.co 

 Ingrese aqu铆 para m谩s informaci贸n: https://72dfe17217744236af40cc31b704a664.us-central1.gcp.cloud.es.io:9243/s/distrital/app/uptime#"""
        }
      }
    }
  },
  "transform": {
    "script": {
      "source": "return [ 'time_triggered': Instant.ofEpochMilli(ctx.trigger.triggered_time.getMillis()).atZone(ZoneId.of('America/Bogota')).format(DateTimeFormatter.ofPattern('YYYY-MM-dd HH:mm:ss')) ];",
      "lang": "painless"
    }
  }
}

and this is the alert that is executed before the previous one is activated....

{
  "trigger": {
    "schedule": {
      "interval": "1h"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "agenteallot*"
        ],
        "rest_total_hits_as_int": true,
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "filter": [
                {
                  "range": {
                    "@timestamp": {
                      "gte": "{{ctx.trigger.scheduled_time}}||-5m",
                      "lte": "{{ctx.trigger.scheduled_time}}",
                      "format": "strict_date_optional_time||basic_time_no_millis"
                    }
                  }
                },
                {
                  "term": {
                    "monitor.name.keyword": "04-1-CAV30CI1012712-VIVERO-PPAL-384M-99.8"
                  }
                }
              ]
            }
          },
          "aggs": {
            "metricAgg": {
              "max": {
                "field": "summary.down"
              }
            }
          }
        }
      }
    }
  },
  "condition": {
    "script": {
      "source": "if (ctx.payload.aggregations.metricAgg.value >= params.threshold) { return true; } return false;",
      "lang": "painless",
      "params": {
        "threshold": 0.8
      }
    }
  },
  "actions": {
    "email_1": {
      "email": {
        "profile": "standard",
        "attach_data": {
          "format": "yaml"
        },
        "to": [
          "victor.vera@megadvantage.com",
          "telecomunicaciones@udistrital.edu.co",
          "juan.jaramillo@megadvantage.com",
          "juancho.jaramillo16@gmail.com",
          "oscar.ninog.pr@etb.com.co",
          "jose.caceresg@etb.com.co",
          "karen.marriagaj.pr@etb.com.co"
        ],
        "subject": "{{ctx.metadata.name}} ",
        "body": {
          "text": """Buen dia, Adjunto registro del reporte.

 鈿狅笍ALERTA NODO!!! El siguiente enlace perdi贸 la conexi贸n. 

 Estado: Down馃敶 

 Nombre del Enlace: 04-1-CAV30CI1012712-VIVERO-PPAL-384M-99.8

 馃暓Hora: {{ctx.payload.time_triggered}}  {{ctx.result.execution_time}}

 脕rea: Networking 

 馃敂Mensaje Alerta: El enlace ha dejado de responder. Responder correo a telecomunicaciones@udistrital.edu.co 

 Ingrese aqu铆 para m谩s informaci贸n: https://72dfe17217744236af40cc31b704a664.us-central1.gcp.cloud.es.io:9243/s/distrital/app/uptime#"""
        }
      }
    }
  },
  "transform": {
    "script": {
      "source": "return [ 'time_triggered': Instant.ofEpochMilli(ctx.trigger.triggered_time.getMillis()).atZone(ZoneId.of('America/Bogota')).format(DateTimeFormatter.ofPattern('YYYY-MM-dd HH:mm:ss')) ];",
      "lang": "painless"
    }
  }
}
2

There is a watcher history index that contains information about all watch executions. You could query that one as part of your watch.

GET .watcher-history-*/_search
{
  "size": 1,
  "query": {
    "bool": {
      "filter": [
        {
          "term": {
            "watch_id": "my_watch"
          }
        }
      ]
    }
  },
  "sort": [
    {
      "trigger_event.triggered_time": {
        "order": "desc"
      }
    }
  ]
}

Hope this helps!

--Alex

3

thanks, but how do I set that up in the watch I mean in the trigger?

4

with a chain input

5

Thanks, very useful, but I have a question when making that input chain, when I run the clock will do that first? ie how can I make the clock runs if it meets a condition of execution, I mean that if you detect that this executed the other clock, run this.

6

I'm sorry, but I have no idea what you refer to by a clock or a clock run, please explain.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.