Hi,
I don't know the best way to do this, so i try to explain it the best i can.
I want to set watches to search if there are errors in my logs. I.e. more than 50 error logs in hte last 5 minutes, and isolate it by host. This means if host1 sent more than 50 error logs in the last 5 minutes i want to receive an e-mail, the same for host2 host3..etc
I guess that i need one watcher per host, right? So i configured it like this:
curl -XPUT 'http://localhost:9200/_watcher/watch/log_error_watch' -d '{
"metadata" : {
"color" : "red"
},
"trigger" : {
"schedule" : {
"interval" : "1m"
}
},
"input" : {
"search" : {
"request" : {
"indices" : "logs",
"body" : {
"size" : 0,
"query": {
"filtered": {
"query" : { "match" : { "message" : "error" } },
"filter": {
"query": {
"term": {
"host": "host1"
},
"query": {
"range": {
"@timestamp": {
"gte": "now-5m",
"lte": "now"
}
}
}
}
}
}
}
}
}
}
},
"condition" : {
"compare" : { "ctx.payload.hits.total" : { "gt" : 50 }}
},
"actions" : {
"email_administrator" : {
"throttle_period": "5m",
"email" : {
"to" : "miemail",
"subject" : "TOMCAT {{ctx.payload.hits.total}} errors",
"body" : "bla bla bla",
"attach_data" : true,
"priority" : "high"
}
}
}
}'
I can create the watch but it does nothing...i don't know how to debug.
So to test it i create data in elasticsearch, ie:
curl -XPOST 'http://localhost:9200/logs/event' -d '{
"timestamp" : "2017-01-09T13:39:29.613Z",
"request" : "GET index.html",
"status_code" : 404,
"host" : "host1",
"message" : "Error: File not found"
}'
Does anyone knows why is not working?
Thank you