# Trigger In elastic search

**URL:** <https://discuss.elastic.co/t/trigger-in-elastic-search/281458>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-monitoring, elastic-stack-alerting\
**Created:** [August 14, 2021, 5:48pm UTC](https://discuss.elastic.co/t/trigger-in-elastic-search/281458 "2021-08-14T17:48:43Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![ashurajchandra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ashurajchandra/32/92908_2.png) [@ashurajchandra](https://discuss.elastic.co/u/ashurajchandra)\
**Post date:** [August 14, 2021, 5:48pm UTC](https://discuss.elastic.co/t/trigger-in-elastic-search/281458/1 "2021-08-14T17:48:43Z")

</div>

I'm working in startup and I got the task of writing trigger for error logs ,  
but not when i'm using

````auto
PUT _watcher/watch/diagnostic_monitor
{
  "metadata" : {
    "color" : "red"
  },
  "trigger" : {
    "schedule" : {
      "interval" : "5m"
    }
  }```

getting this error '{"Message":"Your request: '/_watcher/watch/diagnostic_monitor' is not allowed."}' , i'm using devtool for sending
````

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [August 14, 2021, 6:01pm UTC](https://discuss.elastic.co/t/trigger-in-elastic-search/281458/2 "2021-08-14T18:01:11Z")

</div>

What is it you are trying to achieve?

---

<div class="post-metadata">

**Author:** ![ashurajchandra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ashurajchandra/32/92908_2.png) [@ashurajchandra](https://discuss.elastic.co/u/ashurajchandra)\
**Post date:** [August 14, 2021, 6:13pm UTC](https://discuss.elastic.co/t/trigger-in-elastic-search/281458/3 "2021-08-14T18:13:31Z")

</div>

i want to to make the trigger after every 10 min to see the error logs and send back it to api response

---

<div class="post-metadata">

**Author:** ![ashurajchandra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ashurajchandra/32/92908_2.png) [@ashurajchandra](https://discuss.elastic.co/u/ashurajchandra)\
**Post date:** [August 14, 2021, 6:14pm UTC](https://discuss.elastic.co/t/trigger-in-elastic-search/281458/4 "2021-08-14T18:14:43Z")

</div>

If you can help me out it will be really great

---

<div class="post-metadata">

**Author:** ![Divit\_Sharma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/divit_sharma/32/32348_2.png) [@Divit\_Sharma](https://discuss.elastic.co/u/Divit_Sharma)\
**Post date:** [August 14, 2021, 6:16pm UTC](https://discuss.elastic.co/t/trigger-in-elastic-search/281458/5 "2021-08-14T18:16:40Z")

</div>

Your watcher is not complete. There is no input, condition and action.

---

<div class="post-metadata">

**Author:** ![ashurajchandra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ashurajchandra/32/92908_2.png) [@ashurajchandra](https://discuss.elastic.co/u/ashurajchandra)\
**Post date:** [August 14, 2021, 6:18pm UTC](https://discuss.elastic.co/t/trigger-in-elastic-search/281458/6 "2021-08-14T18:18:28Z")

</div>

full code is here

````auto
PUT _watcher/watch/diagnostic_monitor
{
  "metadata" : {
    "color" : "red"
  },
  "trigger" : {
    "schedule" : {
      "interval" : "5m"
    }
  },
  "input" : {
    "search" : {
      "request" : {
        "indices" : "log-events",
        "body" : {
          "size" : 0,
          "query" : { "match" : { "status" : "error" } }
        }
      }
    }
  },
  "condition" : {
    "compare" : { "ctx.payload.hits.total" : { "gt" : 5 }}
  },
  "transform" : {
    "search" : {
        "request" : {
          "indices" : "log-events",
          "body" : {
            "query" : { "match" : { "status" : "error" } }
          }
        }
    }
  },
  "actions" : {
    "my_webhook" : {
      "webhook" : {
        "method" : "POST",
        "host" : "mylisteninghost",
        "port" : 9200,
        "path" : "/{{watch_id}}",
        "body" : "Encountered {{ctx.payload.hits.total}} errors"
      }
    },
    "email_administrator" : {
      "email" : {
        "to" : "sys.admino@host.domain",
        "subject" : "Encountered {{ctx.payload.hits.total}} errors",
        "body" : "Too many error in the system, see attached data",
        "attachments" : {
          "attached_data" : {
            "data" : {
              "format" : "json"
            }
          }
        },
        "priority" : "high"
      }
    }
  }
}```
````

---

<div class="post-metadata">

**Author:** ![ashurajchandra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ashurajchandra/32/92908_2.png) [@ashurajchandra](https://discuss.elastic.co/u/ashurajchandra)\
**Post date:** [August 14, 2021, 6:20pm UTC](https://discuss.elastic.co/t/trigger-in-elastic-search/281458/7 "2021-08-14T18:20:04Z")

</div>

hey can you tell me what should i put here `PUT _watcher/watch/diagnostic_monitor`

?

---

<div class="post-metadata">

**Author:** ![ashurajchandra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ashurajchandra/32/92908_2.png) [@ashurajchandra](https://discuss.elastic.co/u/ashurajchandra)\
**Post date:** [August 14, 2021, 6:23pm UTC](https://discuss.elastic.co/t/trigger-in-elastic-search/281458/8 "2021-08-14T18:23:25Z")

</div>

why getting this error ?  
`{"Message":"Your request: '/_watcher/watch/diagnostic_monitor' is not allowed."}'`  
I'm using devtool for sending

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [August 14, 2021, 6:28pm UTC](https://discuss.elastic.co/t/trigger-in-elastic-search/281458/9 "2021-08-14T18:28:44Z")

</div>

Which version of Elasticsearch are you using?

---

<div class="post-metadata">

**Author:** ![ashurajchandra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ashurajchandra/32/92908_2.png) [@ashurajchandra](https://discuss.elastic.co/u/ashurajchandra)\
**Post date:** [August 14, 2021, 6:29pm UTC](https://discuss.elastic.co/t/trigger-in-elastic-search/281458/10 "2021-08-14T18:29:19Z")

</div>

I'm sending query using devtool login webapp

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [August 14, 2021, 6:31pm UTC](https://discuss.elastic.co/t/trigger-in-elastic-search/281458/11 "2021-08-14T18:31:15Z")

</div>

That was not what I asked. What do you get if you curl Elasticsearch, e.g. `curl localhost:9200`?

---

<div class="post-metadata">

**Author:** ![ashurajchandra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ashurajchandra/32/92908_2.png) [@ashurajchandra](https://discuss.elastic.co/u/ashurajchandra)\
**Post date:** [August 14, 2021, 6:31pm UTC](https://discuss.elastic.co/t/trigger-in-elastic-search/281458/12 "2021-08-14T18:31:54Z")

</div>

curl: (7) Failed to connect to localhost port 9200: Connection refused

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [August 14, 2021, 6:32pm UTC](https://discuss.elastic.co/t/trigger-in-elastic-search/281458/13 "2021-08-14T18:32:51Z")

</div>

You may need to change the command if you have secured your cluster. If you are using Kibana devtools you can instead run `GET /`.

---

<div class="post-metadata">

**Author:** ![ashurajchandra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ashurajchandra/32/92908_2.png) [@ashurajchandra](https://discuss.elastic.co/u/ashurajchandra)\
**Post date:** [August 14, 2021, 6:33pm UTC](https://discuss.elastic.co/t/trigger-in-elastic-search/281458/14 "2021-08-14T18:33:52Z")

</div>

I want to create the watcher so for that i need to send the same query i sent , right?  
how will i used GET their?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [August 14, 2021, 6:35pm UTC](https://discuss.elastic.co/t/trigger-in-elastic-search/281458/15 "2021-08-14T18:35:58Z")

</div>

It would tell me which version of Elasticsearch you are using, which I asked about earlier.

---

<div class="post-metadata">

**Author:** ![ashurajchandra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ashurajchandra/32/92908_2.png) [@ashurajchandra](https://discuss.elastic.co/u/ashurajchandra)\
**Post date:** [August 14, 2021, 6:36pm UTC](https://discuss.elastic.co/t/trigger-in-elastic-search/281458/16 "2021-08-14T18:36:53Z")

</div>

{  
"name" : "fa6807f386fd134b5bc80e6dfd6cf5fd",  
"cluster\_name" : "359065796489:vista-dev-open",  
"cluster\_uuid" : "QOv0GsdDTciWgCNMG2qJJg",  
"version" : {  
"number" : "7.10.2",  
"build\_flavor" : "oss",  
"build\_type" : "tar",  
"build\_hash" : "unknown",  
"build\_date" : "2021-05-21T20:25:46.519671Z",  
"build\_snapshot" : false,  
"lucene\_version" : "8.7.0",  
"minimum\_wire\_compatibility\_version" : "6.8.0",  
"minimum\_index\_compatibility\_version" : "6.0.0-beta1"  
},  
"tagline" : "You Know, for Search"  
}  
\

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [August 14, 2021, 6:38pm UTC](https://discuss.elastic.co/t/trigger-in-elastic-search/281458/17 "2021-08-14T18:38:31Z")

</div>

> [@ashurajchandra](#):
>
> "build\_flavor" : "oss",

That explains it. Watcher requires the default distribution and is not available in the oss distribution. If you look at the [subscriptions page](https://www.elastic.co/subscriptions) it would also require a commercial subscription.

---

<div class="post-metadata">

**Author:** ![ashurajchandra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ashurajchandra/32/92908_2.png) [@ashurajchandra](https://discuss.elastic.co/u/ashurajchandra)\
**Post date:** [August 14, 2021, 6:39pm UTC](https://discuss.elastic.co/t/trigger-in-elastic-search/281458/18 "2021-08-14T18:39:29Z")

</div>

ohk so that why it is saying `{"Message":"Your request: '/_watcher/watch/diagnostic_monitor' is not allowed."}'`  
not allowed?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [August 14, 2021, 8:23pm UTC](https://discuss.elastic.co/t/trigger-in-elastic-search/281458/19 "2021-08-14T20:23:30Z")

</div>

As your build does no contain this functionality I suspect that is a generic error message for an non-existent endpoint. If you have some third party security plugin installed it could also come from that.

---

<div class="post-metadata">

**Author:** ![ashurajchandra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ashurajchandra/32/92908_2.png) [@ashurajchandra](https://discuss.elastic.co/u/ashurajchandra)\
**Post date:** [August 16, 2021, 10:38am UTC](https://discuss.elastic.co/t/trigger-in-elastic-search/281458/20 "2021-08-16T10:38:52Z")

</div>

How can i check if my build contains this functionality or not?

[Next page](https://discuss.elastic.co/t/trigger-in-elastic-search/281458.md?page=2)