Take action when watch is back to normal (condition unmet)

In our use case, we would like to notify our team when the watch is back to normal, namely the condition is no longer met. For example, we would like to be notified when the log has an error, but also when the error messages disappear.

Is there a way to do that using xpack watch?




as it is quite the philosophical question, if an watch is back to normal, if the condition is met or not, it is something you need to do in your code.

While we do have plans to simplify this, what you need to do currently, is to execute your current input, but on top of that you should execute a query against the watcher history indices, that searches for the last execution of your watch. The watcher history contains information about every watch run that is executed, so this is the place where you can check if the condition was met the last time.

Then you could have two actions, one that executes when the condition is met, and one that executes when you consider everything back to normal.

Hope this helps!


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.