Potential Use Case for Watcher - is this just wrong?

ADMINS: Please feel free to move this to X-Pack. I can't seem to create topics in the X-Pack category, and the description of it says:

For X-Pack related questions, please go to the Elasticsearch, Logstash, Kibana or Beats categories and use then tag your topic with the related functionality.

but there are no Watcher or X-Pack tags available when I create a topic here...


I have an elastic deployment that contains billions of pieces of data that my users may or may not be interested in. Currently I provide a search interface so that my users can access this data.

I want to provide a "Saved Search" capability for my users - they create a search, save it and decide how often they want updates. I then make sure that their search runs every interval and sends them information on new data.


It is conceivable that when a user creates/updates a saved search I could create a watch configured with their desired watcher.
The user is only interested in new data, and I'd want to format it nicely etc, so maybe I could setup a transform that hits my application, compares the new data with the last data, formats a nice email etc.


Is this just wrong? When I first found out about it, it felt like it was the wrong use case for Watcher. But the more I learn about watches, actions, transforms etc, the more it feels possible to make it handle my saved searches idea.

Should I expect any problems if I attempt this?

I'm sort of expecting people to come back and say it's wrong....but I thought it was worth asking this in case I'm surprised.

Let me know what you think!

Actually, all of this may be moot. I don't think we can afford the Alerting module on Elasticstack Features :sob:

It's actually cheaper for me to develop my own saved-search system than it is to buy it from elastic. #NotWorthIt

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.