Use watchers to manage indices and get watcher data into visualisations

Elastic Stack Elasticsearch
1

Hi,

I have two questions:

  1. Is it possible to use watchers to create/delete indices?

  2. How could I get result.input.payload.hits.total into a visualisation?
    In the discovery tab it says that there is no cached mapping for that field, but refreshing the index pattern doesn't help.

2

Hey,

  1. Yes, you can use the webhook action to do that.
  2. This is not possible. In order to find out why, you should take a look at the watch history index template (just use GET _template to check it out. The payload field is never indexed, because it can be highly dynamic and thus cause a mapping explosion as well as cause invalid mappings (one watch has a payload that has a fieldname with a string, the other with an integer) - that's why it is disabled.

Hope this helps!

--Alex

3

Hey Alex,

Thank you for the fast reply.
I'll check out the webhook action.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.