How to get hostname of "Elastic" server / "Cluster" name where the watcher is running?

Elastic Stack Elasticsearch
#1

hi
we have a clustered environment. Is there a way to get where the "watcher" have run? We have putting a same set of watcher ,but needed to ensure only PROD watchers are alerted. Hence wanted to filter on a specific key-word of the "elastic_host" in our logic.

In Splunk , there are default fields like "splunk_server" which comes up with every event. Is there any such fields which may be hidden somewhere for elastic where I can make use upon?

#2

There is no metadata variable for the cluster name. You could use the metadata field in the watch to mark a watch on each cluster as prod or dev.

#3

oh.ok. quite hard for us as there are dozens of systems and ahve to manually add the metadata. anyway, nice to have the ctx to contain cluster-name/servername

#4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.