Performance questions - How many watches can be defined?

Elastic Stack Elasticsearch
1

Are there any watcher devs / beta testers who have some numbers on Watcher performance or limitations?

Let's say the watch is fairly simple, e.g. the example in the docs; triggering when the word "error" is anywhere in the logs indices, scheduled every 10 seconds.

The use case for us would be something like checking the logs on a per-customer basis, so a simple setup would be one watcher per customer. We want to understand when we might start hitting limits, so hopefully someone has experience here?

  • Is there a limit on the number of watches which can be defined?
  • What happens when you have say, 100 watches, executing every 10 seconds?

Thanks!

2

Hi Nick,

There is no limit on how many Watcher can be defined. For Watcher the
number of watches isn't that important for performance, but how many
watches are firing concurrently is and what each Watch is configured to do.

If 100 watches are being fired every 10 seconds, that means that on average
10 watches are being fired at a time, but if these Watches execute their
action depends on the throttling. By default a watch can't execute its
action if the next time a condition of the Watch matches was less than 5
seconds ago. However a Watch can be changed to not throttle at all. I
suggest that you check out these docs about throttling:
https://www.elastic.co/guide/en/watcher/current/watch-anatomy.html#watch-anatomy-throttling

Also whether a watch executes every 10 seconds really depends on what the
watch is doing. For example if the search input is used and the configured
search request takes 15 seconds to execute this is going to have impact on
the fired watches throughput. In this case the execution of next watch
execution is going to get delayed, because Watcher doesn't execute the same
watch multiple times.

Martijn