Import old watches into x-pack

Elastic Stack Elasticsearch
1

I'm wondering if it is possible to import a saved .watches index. I had to reinstall elasticsearch because of a bug and I saved all of the indices on a separate instance of ES with the _reindex command. I then reinstalled ES and reindexed the .watches index back but things don't seem to be working. I can see all of my previous watches when I search the .watches index, but when I try and _execute them, it says they cannot be found (even though I can see them right there!).

Any idea why this would be? Can I change the default watcher index from .watches to something else?

2

This is the error I get:

[2017-06-15T12:32:17,104][ERROR][o.e.x.w.t.a.e.TransportExecuteWatchAction] [watcher] failed to execute [missingcolumn]
org.elasticsearch.ResourceNotFoundException: watch [missingcolumn] does not exist
	at org.elasticsearch.xpack.watcher.transport.actions.execute.TransportExecuteWatchAction.masterOperation(TransportExecuteWatchAction.java:107) [x-pack-5.4.0.jar:5.4.0]
	at org.elasticsearch.xpack.watcher.transport.actions.execute.TransportExecuteWatchAction.masterOperation(TransportExecuteWatchAction.java:65) [x-pack-5.4.0.jar:5.4.0]
	at org.elasticsearch.action.support.master.TransportMasterNodeAction.masterOperation(TransportMasterNodeAction.java:87) [elasticsearch-5.4.0.jar:5.4.0]
	at org.elasticsearch.action.support.master.TransportMasterNodeAction$AsyncSingleAction$2.doRun(TransportMasterNodeAction.java:166) [elasticsearch-5.4.0.jar:5.4.0]
	at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:638) [elasticsearch-5.4.0.jar:5.4.0]
	at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) [elasticsearch-5.4.0.jar:5.4.0]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [?:1.8.0_111]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [?:1.8.0_111]
	at java.lang.Thread.run(Thread.java:745) [?:1.8.0_111]

And when I search

GET .watches/_search
{"query":{"match":{"_id":"missingcolumn"}},"size":100}

Response is:

"hits": {
    "total": 1,
    "max_score": 1,
    "hits": [
      {
        "_index": ".watches",
        "_type": "watch",
        "_id": "missingcolumn",
        "_score": 1,
        "_source": {
          "trigger": {
            "schedule": {
              "interval": "40m"
            }
          },
          "input": {
            "http": {
              "request": {
                 ......etc.....
3

Hi,

before you reindex the watches, make sure you are stopping watcher. When the reindex is finished start watcher again. This generates all the required in memory data structures for watch execution.

You can also try to run a watcher restart now and it should work.

--Alex

4

Ok, I had to manually re-add all of my watches this time but I'll try to shutdown watcher and/or do the watcher restart to make it appear if this were to happen again. Thanks Alex

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.