Hi Gidi and thank you
I've given the Watcher a try, but I'm not 100% sure if this is correct:
{
"trigger": {
"schedule": {
"interval": "1m"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"logs"
],
"rest_total_hits_as_int": true,
"body": {
"query": {
"bool": {
"must": [
{
"match": {
"message": "*websocket*"
}
}
],
"filter": [
{
"range": {
"logTimestamp": {
"gte": "now-7d",
"lt": "now"
}
}
}
]
}
},
"_source": [
"message"
],
"sort": [
{
"@timestamp": {
"order": "desc"
}
}
]
}
}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gt": 0
}
}
},
"actions": {
"send_email": {
"throttle_period_in_millis": 120000,
"email": {
"profile": "standard",
"to": [
"werner@blah.com"
],
"subject": "Kibana alert",
"body": {
"text": "Error message: {{ctx.payload.hits.hits.0._source.syslog_message}} "
}
}
},
"log": {
"logging": {
"level": "info",
"text": "{{ctx.payload.hits.total}} Errors have occured in the logs:{{#ctx.payload.hits.hits}}{{_id}}:{{/ctx.payload.hits.hits}}"
}
}
},
"throttle_period_in_millis": 900000
}
This is what I get when the watcher is executed:
{
"watch_id": "b5ec3c71-9263-4c2c-a848-ac5ac857d4dc",
"node": "Lmrgs_M5S4uWAAXFHAIR9g",
"state": "execution_not_needed",
"user": "werner",
"status": {
"state": {
"active": true,
"timestamp": "2020-11-30T11:33:21.384Z"
},
"last_checked": "2020-11-30T11:36:02.126Z",
"actions": {
"log": {
"ack": {
"timestamp": "2020-11-30T11:33:21.384Z",
"state": "awaits_successful_execution"
}
},
"send_email": {
"ack": {
"timestamp": "2020-11-30T11:33:21.384Z",
"state": "awaits_successful_execution"
}
}
},
"execution_state": "execution_not_needed",
"version": -1
},
"trigger_event": {
"type": "schedule",
"triggered_time": "2020-11-30T11:36:02.126Z",
"schedule": {
"scheduled_time": "2020-11-30T11:36:01.831Z"
}
},
"input": {
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"logs"
],
"rest_total_hits_as_int": true,
"body": {
"query": {
"bool": {
"must": [
{
"match": {
"message": "*websocket*"
}
}
],
"filter": [
{
"range": {
"logTimestamp": {
"gte": "now-7d",
"lt": "now"
}
}
}
]
}
},
"_source": [
"message"
],
"sort": [
{
"@timestamp": {
"order": "desc"
}
}
]
}
}
}
},
"condition": {
"compare": {
"ctx.payload.hits.total": {
"gt": 0
}
}
},
"metadata": {
"name": "Test watch",
"xpack": {
"type": "json"
}
},
"result": {
"execution_time": "2020-11-30T11:36:02.126Z",
"execution_duration": 0,
"input": {
"type": "search",
"status": "success",
"payload": {
"_shards": {
"total": 0,
"failed": 0,
"successful": 0,
"skipped": 0
},
"hits": {
"hits": [],
"total": 0,
"max_score": 0
},
"took": 0,
"timed_out": false
},
"search": {
"request": {
"search_type": "query_then_fetch",
"indices": [
"logs"
],
"rest_total_hits_as_int": true,
"body": {
"query": {
"bool": {
"must": [
{
"match": {
"message": "*exception*"
}
}
],
"filter": [
{
"range": {
"logTimestamp": {
"gte": "now-7d",
"lt": "now"
}
}
}
]
}
},
"_source": [
"message"
],
"sort": [
{
"@timestamp": {
"order": "desc"
}
}
]
}
}
}
},
"condition": {
"type": "compare",
"status": "success",
"met": false,
"compare": {
"resolved_values": {
"ctx.payload.hits.total": 0
}
}
},
"actions": []
},
"messages": []
}