Is there a way to deploy new watch (Alerting) w/o resetting action throttle

Elastic Stack Elasticsearch
1

I'm using ELK + X-Pack Alerting 6.2.3. We deploy multiple watch definitions through an automated process whenever one of our watch definitions changes. This means watches whose actions are throttled are updated even through they haven't changed. This update causes the throttle to be cleared and actions are taken more often than desired. Is there a way to use this call without changing the action throttles?

PUT _xpack/watcher/watch/{watch_id}

2

Hey,

putting a new watch always resets the status currently, as there is no mechanism to check for changes on the watcher side, the status is always reset.

--Alex

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.