Is there a repo of watches

Elastic Stack Elasticsearch
1

or some sample/example watches, I am looking for something that sends an email when a httpd 404 occurs

I wrote this:
http://pastebin.com/XPAaYM8U

This is what it looks like in Kibana:
http://pastebin.com/xw4eTi1N

but have one question:
Should sendmail be installed, started and enabled on all the nodes of the cluster

2

Hey,

you might want to check out our new Watcher Labs Series], which shows you some of those examples.

That said, you should get into a certain workflow state to easily test your watches:

  1. First make sure, that you search actuallty returns any results. In this case this will likely fail, beacuse you have specified an index that does not exist (missing an asterisk at the end)
  2. If that works, write up your watch, and store it
  3. If that has worked, use the execute watch api and check the output

In addition you can also use the execute watch api without persisting a watch, which should speed up development a lot.

Hope this helps.

--Alex

3

Well, even something as simple as this: http://pastebin.com/hhNxSEvU
does not seem to work
here's what I am "grepping": http://pastebin.com/HKzDSuEs

4

Hey,

please reread my comment above and apply the workflow I laid out. If you want to dig into the problem, you need to understand why something fails. And this is why you need to use the execute watch API. I can see that your condition will never work, but it's not durable to post things into the forum, if you need to solve issues fast :slight_smile:

Use the execute watch API, check the condition documentation and especially take your time to read the output of the execute watch API, which contains information about each step executed. If your condition never turns true, there might be an error with the condition.

Just adding pastebins of your watches wont help either, because in order to debug one always needs the watch as well as the response. Otherwise it is impossible for other folks to help. Writing a clear and concise problem statement is a hard thing, but you're making the life of everyone easier who reads your post and increase the likelyhood of getting help by tenfold.

--Alex

5

So I copied verbatim(almost) from the ES website, still no go:
http://pastebin.com/xHC8iDrK

6

I think I got it I was doing curl -XPUL to the kibana (neither a master nor a data node) host, doing it to a data node works. Thanks for all your efforts.