I need to Configure a Watcher that after of the alarm is triggered for first time, the interval de execution increase to 30 minutes

Elastic Stack Elasticsearch
1

Hello, I have an alarm developed in a wacther in kibana and the interval from execution is 1 minute so when the condition is true a long time, this alarm activates all time.
I need that after of the alarm is triggered for first time, the interval de execution increase to 30 minutes.

{
  "trigger": {
    "schedule": {
      "interval": "1m"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "example-*"
        ],
        "types": [],
        "body": {
          "size": 0,
          "query": {
            "bool": {
              "must": [
                {
                  "query_string": {
                    "query": "match1"
                  }
                },
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-1m",
                      "lte": "now",
                      "time_zone": "-05:00"
                    }
                  }
                }
              ]
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gte": 30
      }
    }
  },
  "actions": {
    "send_email": {
      "email": {
        "profile": "standard",
        "priority": "normal",
        "to": [
          "<foo@foo.com>,<foo@foo.com>"
        ],
        "subject": "Watcher Kibana Errors - match1",
        "body": {
          "text": "foooo {{ctx.payload.hits.total}} errors match1"
        }
      }
    }
  }
}

Thanks you!

2

Would action throttling work for you instead?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.